# Part 3 — Boundary Mathematics: When PAGE_SHIFT Eats Itself
The previous section was about lying to allocators. This section is about lying to arithmetic.
The Linux memory management subsystem is built on a foundation that assumes file sizes are sane. Not bounded by hardware, not bounded by physics — bounded by code. Specifically bounded by `MAX_LFS_FILESIZE`, a single macro that every VFS path is supposed to enforce before any byte offset gets shifted into a page index. When a malicious FUSE daemon returns `attr.size = 0xFFFFFFFFFFFFFFFF` in response to a `vfs_getattr` call, it is not just lying about a file’s size. It is feeding poison into bitwise expressions that the kernel will evaluate hundreds of times per second across `mm/filemap.c`, `mm/mmap.c`, `mm/readahead.c`, and the entire folio infrastructure.
The math breaks. And when math breaks in the page cache, the XArray walks off a cliff.
# 3.1 The Constants That Are Supposed To Save You
Let’s nail down the invariants the kernel relies on. From `include/linux/fs.h` on a modern 64-bit build:
/* include/linux/fs.h */
#if BITS_PER_LONG == 32
#define MAX_LFS_FILESIZE (((loff_t)PAGE_SIZE << (BITS_PER_LONG-1)) - 1)
#elif BITS_PER_LONG == 64
#define MAX_LFS_FILESIZE ((loff_t)LLONG_MAX)
#endif
On x86\_64 / arm64 / riscv64, `MAX_LFS_FILESIZE` evaluates to `0x7FFFFFFFFFFFFFFF`. That high bit being clear is not cosmetic — it exists specifically to prevent the maximum file size from being interpreted as a negative `loff_t` (which is signed) anywhere in the kernel.
Then we have the page-shift constants:
/* include/asm-generic/page.h and arch-specific overrides */
#define PAGE_SHIFT 12 /* 4 KiB pages, standard */
#define PAGE_SIZE (1UL << PAGE_SHIFT) /* 0x1000 */
#define PAGE_MASK (~(PAGE_SIZE - 1)) /* 0xFFFFFFFFFFFFF000 */
And the type that everything iterates over:
/* include/linux/types.h */
typedef unsigned long pgoff_t; /* 64-bit on LP64 */
`pgoff_t` is **unsigned**. There is no underflow detection. There is no overflow detection. There are only bits, and the bits do exactly what bits do when you tell them to.
FUSE’s super-block initialization correctly clamps:
/* fs/fuse/inode.c — fuse_fill_super_common() */
sb->s_maxbytes = MAX_LFS_FILESIZE;
That’s the gate. That’s the only gate. And it gates the **superblock**, not individual inode metadata refreshes. Once a FUSE daemon has the connection established, every subsequent `FUSE_GETATTR` reply can mutate `inode->i_size` to any 64-bit value it wants. The `s_maxbytes` check is **not re-applied** per-getattr in the hot paths — it is checked at write extension time (`generic_write_check_limits()`), not at read time, and not when `mm/` subsystems synthesize page indices from a freshly-poisoned `i_size`.
The gate is open. The math begins.
more on the blog
SOCIAL SHARE CARD GENERATOR