syzbot reports a WARN_ON in iomap_iter_done() when iter->pos advances past the end of the current iomap during buffered writes. This happens when a write completes and updates iter->pos beyond the mapped extent before a new iomap is obtained, violating the invariant that iter->pos must lie within the active iomap range. Detect this condition early and mark the mapping stale so the iterator restarts with a fresh iomap covering the current position. Fixes: a66191c590b3b58eaff05d2277971f854772bd5b ("iomap: tighten iterator state validation") Tested-by: Piyush Patle Signed-off-by: Piyush Patle Reported-by: syzbot+bd5ca596a01d01bfa083@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=bd5ca596a01d01bfa083 --- fs/iomap/iter.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/iomap/iter.c b/fs/iomap/iter.c index c04796f6e57f..466a12b0c094 100644 --- a/fs/iomap/iter.c +++ b/fs/iomap/iter.c @@ -111,6 +111,13 @@ int iomap_iter(struct iomap_iter *iter, const struct iomap_ops *ops) &iter->iomap, &iter->srcmap); if (ret < 0) return ret; + if (iter->iomap.length && + iter->iomap.offset + iter->iomap.length <= iter->pos) { + iter->iomap.flags |= IOMAP_F_STALE; + iomap_iter_reset_iomap(iter); + return 1; + } + iomap_iter_done(iter); return 1; } -- 2.34.1