Patch "afs: Fix afs_fs_fetch_data() to subtract transferred from len" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix afs_fs_fetch_data() to subtract transferred from len

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 222052c6be186f2074b3a4d741d5de200f654c43 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Thu, 23 Jul 2026 12:34:47 +0100
Subject: afs: Fix afs_fs_fetch_data() to subtract transferred from len

From: David Howells <dhowells at redhat.com>

commit 222052c6be186f2074b3a4d741d5de200f654c43 upstream.

Fix afs_fs_fetch_data() to subtract subreq->transferred from subreq->len
rather than adding it.

Fixes: f28fc2010d62 ("afs: Eliminate afs_read")
Link: https://sashiko.dev/#/patchset/20260713081022.2186481-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://patch.msgid.link/20260723113452.566619-3-dhowells@redhat.com
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/fsclient.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index 626e1d37b915..1a3f186a6a11 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -487,7 +487,7 @@ void afs_fs_fetch_data(struct afs_operation *op)
 	bp[2] = htonl(vp->fid.vnode);
 	bp[3] = htonl(vp->fid.unique);
 	bp[4] = htonl(lower_32_bits(subreq->start + subreq->transferred));
-	bp[5] = htonl(lower_32_bits(subreq->len   + subreq->transferred));
+	bp[5] = htonl(lower_32_bits(subreq->len   - subreq->transferred));
 
 	call->fid = vp->fid;
 	trace_afs_make_fs_call(call, &vp->fid);
-- 
2.55.0



Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/netfs-release-readahead-folios-on-iterator-preparati.patch
queue-6.18/netfs-handle-single-writeback-rolling-buffer-allocat.patch
queue-6.18/netfs-clear-pg_private_2-on-copy-to-cache-append-fai.patch
queue-6.18/afs-fix-uaf-when-sending-a-message.patch
queue-6.18/afs-fix-afs_fs_fetch_data-to-set-call-async.patch
queue-6.18/afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch