In
d3dd531213 we dropped "erofs: verify metadata accesses for file-backed
mounts" (upstream
307210c262a2) per Gao Xiang's request (Android SELinux
regression). The follow-up:
"erofs: fix offset truncation when shifting pgoff on 32-bit platforms"
(upstream
c99493ce409c)
is queued in 7.0/6.18/6.12 and carries
Fixes: 307210c262a2 ("erofs: verify metadata accesses for file-backed mounts")
Its data.c hunk converts
fpos = index << PAGE_SHIFT;
err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
to use a (loff_t) cast on the shift. That entire rw_verify_area() block
was introduced by
307210c262a2, which is no longer in the queue or in
the corresponding stable bases (stable/linux-{7.0,6.18,6.12}.y do not
contain rw_verify_area in fs/erofs/data.c). The hunk cannot apply.
Drop the follow-up from queue-7.0, queue-6.18, and queue-6.12.
Signed-off-by: Sasha Levin <sashal@kernel.org>
+++ /dev/null
-From 387c953cfa5407191c1f7bca3731d349f6284cdb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 20 Apr 2026 11:46:12 +0800
-Subject: erofs: fix offset truncation when shifting pgoff on 32-bit platforms
-
-From: Gao Xiang <hsiangkao@linux.alibaba.com>
-
-[ Upstream commit c99493ce409c3b98fec1616dbcf24c102e006deb ]
-
-On 32-bit platforms, pgoff_t is 32 bits wide, so left-shifting
-large arbitrary pgoff_t values by PAGE_SHIFT performs 32-bit arithmetic
-and silently truncates the result for pages beyond the 4 GiB boundary.
-
-Cast the page index to loff_t before shifting to produce a correct
-64-bit byte offset.
-
-Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy")
-Fixes: 307210c262a2 ("erofs: verify metadata accesses for file-backed mounts")
-Reviewed-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/data.c | 2 +-
- fs/erofs/zdata.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/fs/erofs/data.c b/fs/erofs/data.c
-index 192c7ed885acd..21476bd6ae9de 100644
---- a/fs/erofs/data.c
-+++ b/fs/erofs/data.c
-@@ -39,7 +39,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset,
- * However, the data access range must be verified here in advance.
- */
- if (buf->file) {
-- fpos = index << PAGE_SHIFT;
-+ fpos = (loff_t)index << PAGE_SHIFT;
- err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
- if (err < 0)
- return ERR_PTR(err);
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index a81b6e6aee59a..e438b8c9bf03b 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -1853,7 +1853,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
-
- if (cur < PAGE_SIZE)
- break;
-- cur = (index << PAGE_SHIFT) - 1;
-+ cur = ((loff_t)index << PAGE_SHIFT) - 1;
- }
- }
-
---
-2.53.0
-
loongarch-kvm-compile-switch.s-directly-into-the-ker.patch
ntfs-d_compare-must-not-block.patch
pci-initialize-temporary-device-in-new_id_store.patch
-erofs-fix-offset-truncation-when-shifting-pgoff-on-3.patch
net-bcmgenet-initialize-u64-stats-seq-counter.patch
net-bcmgenet-fix-leaking-free_bds.patch
iommu-amd-reorder-attach-device-code.patch
+++ /dev/null
-From bde9bd5168c48a6040f3f57af74fc23dd917ee26 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 20 Apr 2026 11:46:12 +0800
-Subject: erofs: fix offset truncation when shifting pgoff on 32-bit platforms
-
-From: Gao Xiang <hsiangkao@linux.alibaba.com>
-
-[ Upstream commit c99493ce409c3b98fec1616dbcf24c102e006deb ]
-
-On 32-bit platforms, pgoff_t is 32 bits wide, so left-shifting
-large arbitrary pgoff_t values by PAGE_SHIFT performs 32-bit arithmetic
-and silently truncates the result for pages beyond the 4 GiB boundary.
-
-Cast the page index to loff_t before shifting to produce a correct
-64-bit byte offset.
-
-Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy")
-Fixes: 307210c262a2 ("erofs: verify metadata accesses for file-backed mounts")
-Reviewed-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/data.c | 2 +-
- fs/erofs/zdata.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/fs/erofs/data.c b/fs/erofs/data.c
-index 58aea2b48580c..d685ee1d9c554 100644
---- a/fs/erofs/data.c
-+++ b/fs/erofs/data.c
-@@ -38,7 +38,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
- * However, the data access range must be verified here in advance.
- */
- if (buf->file) {
-- fpos = index << PAGE_SHIFT;
-+ fpos = (loff_t)index << PAGE_SHIFT;
- err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
- if (err < 0)
- return ERR_PTR(err);
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index 71f01f0a07435..0f09f3ba32149 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -1869,7 +1869,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
-
- if (cur < PAGE_SIZE)
- break;
-- cur = (index << PAGE_SHIFT) - 1;
-+ cur = ((loff_t)index << PAGE_SHIFT) - 1;
- }
- }
-
---
-2.53.0
-
revert-pseries-papr-hvpipe-fix-race-with-interrupt-h.patch
revert-papr-hvpipe-convert-papr_hvpipe_dev_create_ha.patch
pci-initialize-temporary-device-in-new_id_store.patch
-erofs-fix-offset-truncation-when-shifting-pgoff-on-3.patch
bpf-fix-sync_linked_regs-regarding-bpf_add_const32-z.patch
net-airoha-fix-a-copy-and-paste-bug-in-probe.patch
fuse-fix-race-when-disposing-stale-dentries.patch
+++ /dev/null
-From 145e38f862063694f3a0f2903496726af5014411 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 20 Apr 2026 11:46:12 +0800
-Subject: erofs: fix offset truncation when shifting pgoff on 32-bit platforms
-
-From: Gao Xiang <hsiangkao@linux.alibaba.com>
-
-[ Upstream commit c99493ce409c3b98fec1616dbcf24c102e006deb ]
-
-On 32-bit platforms, pgoff_t is 32 bits wide, so left-shifting
-large arbitrary pgoff_t values by PAGE_SHIFT performs 32-bit arithmetic
-and silently truncates the result for pages beyond the 4 GiB boundary.
-
-Cast the page index to loff_t before shifting to produce a correct
-64-bit byte offset.
-
-Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy")
-Fixes: 307210c262a2 ("erofs: verify metadata accesses for file-backed mounts")
-Reviewed-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/data.c | 2 +-
- fs/erofs/zdata.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/fs/erofs/data.c b/fs/erofs/data.c
-index 132a27deb2f3b..b2c12c5856acc 100644
---- a/fs/erofs/data.c
-+++ b/fs/erofs/data.c
-@@ -39,7 +39,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
- * However, the data access range must be verified here in advance.
- */
- if (buf->file) {
-- fpos = index << PAGE_SHIFT;
-+ fpos = (loff_t)index << PAGE_SHIFT;
- err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
- if (err < 0)
- return ERR_PTR(err);
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index fe8121df9ef2f..624b83ff4ecb7 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -1874,7 +1874,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
-
- if (cur < PAGE_SIZE)
- break;
-- cur = (index << PAGE_SHIFT) - 1;
-+ cur = ((loff_t)index << PAGE_SHIFT) - 1;
- }
- }
-
---
-2.53.0
-
crypto-sa2ul-fix-aead-fallback-algorithm-names.patch
crypto-ccp-copy-iv-using-skcipher-ivsize.patch
sh-include-linux-io.h-in-dac.h.patch
-erofs-fix-offset-truncation-when-shifting-pgoff-on-3.patch
erofs-unify-lcn-as-u64-for-32-bit-platforms.patch
tools-hv-fix-cross-compilation.patch
drivers-hv-vmbus-fix-hyperv_cpuhp_online-variable-sh.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
