Subject: + fsnotify-pass-correct-offset-to-fsnotify_mmap_perm.patch added to mm-hotfixes-unstable branch

From: Andrew Morton <[email-masked]>
Date: Fri, 03 Oct 2025 13:04:25 -0700

The patch titled
     Subject: fsnotify: pass correct offset to fsnotify_mmap_perm()
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     fsnotify-pass-correct-offset-to-fsnotify_mmap_perm.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/fsnotify-pass-correct-offset-to-fsnotify_mmap_perm.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Ryan Roberts <[email-masked]>
Subject: fsnotify: pass correct offset to fsnotify_mmap_perm()
Date: Fri, 3 Oct 2025 16:52:36 +0100

fsnotify_mmap_perm() requires a byte offset for the file about to be
mmap'ed.  But it is called from vm_mmap_pgoff(), which has a page offset. 
Previously the conversion was done incorrectly so let's fix it, being
careful not to overflow on 32-bit platforms.

Discovered during code review.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 066e053fe208 ("fsnotify: add pre-content hooks on mmap()")
Signed-off-by: Ryan Roberts <[email-masked]>
Reviewed-by: Kiryl Shutsemau <[email-masked]>
Cc: Amir Goldstein <[email-masked]>
Cc: David Hildenbrand <[email-masked]>
Cc: Liam Howlett <[email-masked]>
Cc: Lorenzo Stoakes <[email-masked]>
Cc: Michal Hocko <[email-masked]>
Cc: Mike Rapoport <[email-masked]>
Cc: Suren Baghdasaryan <[email-masked]>
Cc: Vlastimil Babka <[email-masked]>
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
---

 mm/util.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/mm/util.c~fsnotify-pass-correct-offset-to-fsnotify_mmap_perm
+++ a/mm/util.c
@@ -566,6 +566,7 @@ unsigned long vm_mmap_pgoff(struct file
 	unsigned long len, unsigned long prot,
 	unsigned long flag, unsigned long pgoff)
 {
+	loff_t off = (loff_t)pgoff << PAGE_SHIFT;
 	unsigned long ret;
 	struct mm_struct *mm = current->mm;
 	unsigned long populate;
@@ -573,7 +574,7 @@ unsigned long vm_mmap_pgoff(struct file
 
 	ret = security_mmap_file(file, prot, flag);
 	if (!ret)
-		ret = fsnotify_mmap_perm(file, prot, pgoff >> PAGE_SHIFT, len);
+		ret = fsnotify_mmap_perm(file, prot, off, len);
 	if (!ret) {
 		if (mmap_write_lock_killable(mm))
 			return -EINTR;
_

Patches currently in -mm which might be from [email-masked] are

fsnotify-pass-correct-offset-to-fsnotify_mmap_perm.patch