From: Sasha Levin Date: Sun, 5 Jul 2026 14:30:49 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=75ea8ceffead4932a391675756bb170dd0e26bf3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch b/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch new file mode 100644 index 0000000000..ebd346d294 --- /dev/null +++ b/queue-6.12/bcachefs-avoid-truncating-fiemap-extent-length.patch @@ -0,0 +1,74 @@ +From f53d2cf65894fcec5367ed32febd7d7ac2f902fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2026 14:48:13 +0300 +Subject: bcachefs: avoid truncating fiemap extent length + +From: Mikhail Dmitrichenko + +No upstream commit exists for this patch. + +bkey sizes are stored in sectors as u32, while fiemap reports byte +lengths as u64. Shifting k.k->size before widening performs the +conversion in 32 bits, so an extent of 4 GiB or larger can wrap before +it is passed to fiemap_fill_next_extent(). + +Compute the byte length after casting the sector count to u64 and reuse +it for all bch2_fill_extent() cases. + +The same issue was fixed in bcachefs-tools, but there is no Linux +upstream commit to backport to 6.12. The affected 6.12 implementation lives +in fs/bcachefs/fs.c, while the bcachefs-tools fix touches +fs/bcachefs/vfs/fiemap.c. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lore.kernel.org/linux-bcachefs/20260610105547.129545-1-mdmitrichenko@astralinux.ru/ +Link: https://evilpiepirate.org/git/bcachefs-tools.git/commit/?id=6d9a895ed00d4b3868312df93253d2a817b0c6a3 +Signed-off-by: Mikhail Dmitrichenko +Acked-by: Kent Overstreet +Signed-off-by: Sasha Levin +--- + fs/bcachefs/fs.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c +index a41d0d8a2f7beb..0dc2466de3f91c 100644 +--- a/fs/bcachefs/fs.c ++++ b/fs/bcachefs/fs.c +@@ -1184,6 +1184,8 @@ static int bch2_fill_extent(struct bch_fs *c, + struct fiemap_extent_info *info, + struct bkey_s_c k, unsigned flags) + { ++ u64 len = (u64)k.k->size << 9; ++ + if (bkey_extent_is_direct_data(k.k)) { + struct bkey_ptrs_c ptrs = bch2_bkey_ptrs_c(k); + const union bch_extent_entry *entry; +@@ -1212,7 +1214,7 @@ static int bch2_fill_extent(struct bch_fs *c, + ret = fiemap_fill_next_extent(info, + bkey_start_offset(k.k) << 9, + offset << 9, +- k.k->size << 9, flags|flags2); ++ len, flags | flags2); + if (ret) + return ret; + } +@@ -1221,13 +1223,13 @@ static int bch2_fill_extent(struct bch_fs *c, + } else if (bkey_extent_is_inline_data(k.k)) { + return fiemap_fill_next_extent(info, + bkey_start_offset(k.k) << 9, +- 0, k.k->size << 9, ++ 0, len, + flags| + FIEMAP_EXTENT_DATA_INLINE); + } else if (k.k->type == KEY_TYPE_reservation) { + return fiemap_fill_next_extent(info, + bkey_start_offset(k.k) << 9, +- 0, k.k->size << 9, ++ 0, len, + flags| + FIEMAP_EXTENT_DELALLOC| + FIEMAP_EXTENT_UNWRITTEN); +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index f63cf92650..cf03f1a136 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -3,3 +3,4 @@ nfsd-fix-file-change-detection-in-cb_getattr.patch nfsd-release-layout-stid-on-setlease-failure.patch userfaultfd-gate-must_wait-writability-check-on-pte_.patch perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch +bcachefs-avoid-truncating-fiemap-extent-length.patch