Description of problem:
Reported by Thomas Pollet.

In mm/fremap.c :

  146 #if PTE_FILE_MAX_BITS < BITS_PER_LONG
  147         if (pgoff + (size >> PAGE_SHIFT) >= (1UL << PTE_FILE_MAX_BITS))
  148                 return err;

the first part of the if statement could overflow .

attached is some code that implements remap_file_pages if you want to check it: if run like ./a.out 6710886 10000, for example, the pgoff survives as a negative value and is used.

Acknowledgements:

Red Hat would like to thank Thomas Pollet for reporting this issue.