From: Marco Nelissen <marco.nelissen@gmail.com> mainline inclusion from mainline-v6.10-rc2 commit c13094b894de289514d84b8db56d1f2931a0bade category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXF0 CVE: CVE-2025-21667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Signed-off-by: Marco Nelissen <marco.nelissen@gmail.com> Link: https://lore.kernel.org/r/20250109041253.2494374-1-marco.nelissen@gmail.com Reviewed-by: Darrick J. Wong <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Christian Brauner <brauner@kernel.org> Conflicts: fs/xfs/xfs_iomap.c fs/iomap/buffered-io.c [Conflicts due to not merged 492f53758fad ("iomap: pass the iomap to the punch callback")] Signed-off-by: Long Li <leo.lilong@huawei.com> --- fs/xfs/xfs_iomap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index dc01689988ab..7395674066cf 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1191,11 +1191,11 @@ xfs_iomap_write_delalloc_scan( * the end of this data range, not the end of the folio. */ *punch_start_byte = min_t(loff_t, end_byte, - (page->index + 1) << PAGE_SHIFT); + page_offset(page) + PAGE_SIZE); } /* move offset to start of next folio in range */ - start_byte = (page->index + 1) << PAGE_SHIFT; + start_byte = page_offset(page) + PAGE_SIZE; unlock_page(page); put_page(page); } -- 2.39.2