Fixes for all trees

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch b/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch
new file mode 100644 (file)
index 0000000..ebd346d
--- /dev/null
+++ b/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch
@@ -0,0 +1,74 @@
+From f53d2cf65894fcec5367ed32febd7d7ac2f902fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 14:48:13 +0300
+Subject: bcachefs: avoid truncating fiemap extent length
+
+From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
+
+No upstream commit exists for this patch.
+
+bkey sizes are stored in sectors as u32, while fiemap reports byte
+lengths as u64. Shifting k.k->size before widening performs the
+conversion in 32 bits, so an extent of 4 GiB or larger can wrap before
+it is passed to fiemap_fill_next_extent().
+
+Compute the byte length after casting the sector count to u64 and reuse
+it for all bch2_fill_extent() cases.
+
+The same issue was fixed in bcachefs-tools, but there is no Linux
+upstream commit to backport to 6.12. The affected 6.12 implementation lives
+in fs/bcachefs/fs.c, while the bcachefs-tools fix touches
+fs/bcachefs/vfs/fiemap.c.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Link: https://lore.kernel.org/linux-bcachefs/20260610105547.129545-1-mdmitrichenko@astralinux.ru/
+Link: https://evilpiepirate.org/git/bcachefs-tools.git/commit/?id=6d9a895ed00d4b3868312df93253d2a817b0c6a3
+Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
+Acked-by: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bcachefs/fs.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c
+index a41d0d8a2f7beb..0dc2466de3f91c 100644
+--- a/fs/bcachefs/fs.c
++++ b/fs/bcachefs/fs.c
+@@ -1184,6 +1184,8 @@ static int bch2_fill_extent(struct bch_fs *c,
+                           struct fiemap_extent_info *info,
+                           struct bkey_s_c k, unsigned flags)
+ {
++      u64 len = (u64)k.k->size << 9;
++
+       if (bkey_extent_is_direct_data(k.k)) {
+               struct bkey_ptrs_c ptrs = bch2_bkey_ptrs_c(k);
+               const union bch_extent_entry *entry;
+@@ -1212,7 +1214,7 @@ static int bch2_fill_extent(struct bch_fs *c,
+                       ret = fiemap_fill_next_extent(info,
+                                               bkey_start_offset(k.k) << 9,
+                                               offset << 9,
+-                                              k.k->size << 9, flags|flags2);
++                                              len, flags | flags2);
+                       if (ret)
+                               return ret;
+               }
+@@ -1221,13 +1223,13 @@ static int bch2_fill_extent(struct bch_fs *c,
+       } else if (bkey_extent_is_inline_data(k.k)) {
+               return fiemap_fill_next_extent(info,
+                                              bkey_start_offset(k.k) << 9,
+-                                             0, k.k->size << 9,
++                                             0, len,
+                                              flags|
+                                              FIEMAP_EXTENT_DATA_INLINE);
+       } else if (k.k->type == KEY_TYPE_reservation) {
+               return fiemap_fill_next_extent(info,
+                                              bkey_start_offset(k.k) << 9,
+-                                             0, k.k->size << 9,
++                                             0, len,
+                                              flags|
+                                              FIEMAP_EXTENT_DELALLOC|
+                                              FIEMAP_EXTENT_UNWRITTEN);
+-- 
+2.53.0
+

diff --git a/queue-6.12/series b/queue-6.12/series
index f63cf926508889647ba0830d5d624210b3e41b92..cf03f1a1365a9e26e6bfda1f39ec5722b093802f 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -3,3 +3,4 @@ nfsd-fix-file-change-detection-in-cb_getattr.patch
 nfsd-release-layout-stid-on-setlease-failure.patch
 userfaultfd-gate-must_wait-writability-check-on-pte_.patch
 perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch
+bcachefs-avoid-truncating-fiemap-extent-length.patch