From d8c2bc88460f89e543ab3af622fc8f34c7011d71 Mon Sep 17 00:00:00 2001 From: Daejun Park Date: Thu, 29 Oct 2026 11:23:01 +0900 Subject: [PATCH] xfs: clamp a pNFS LAYOUTCOMMIT extent before computing its end xfs_fs_commit_blocks() adds the client's length to the offset before it clamps the end to the file size. A large length wraps the sum and reaches xfs_iomap_write_unwritten() unclamped. With the previous two patches the LAYOUTCOMMIT then fails with -EIO and converts nothing. Clamp the length first. Fixes: 527851124d10 ("xfs: implement pNFS export operations") Cc: stable@vger.kernel.org Signed-off-by: Daejun Park Reviewed-by: Christoph Hellwig Reviewed-by: Pankaj Raghav Signed-off-by: Carlos Maiolino --- fs/xfs/xfs_pnfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c index 7ff83274a513..19eb18e1290c 100644 --- a/fs/xfs/xfs_pnfs.c +++ b/fs/xfs/xfs_pnfs.c @@ -328,9 +328,7 @@ xfs_fs_commit_blocks( if (start > size) continue; - end = start + maps[i].length; - if (end > size) - end = size; + end = start + min_t(u64, maps[i].length, size - start); length = end - start; if (!length)