Commit 25307ca50b815 ("fuse: simplify logic in fuse_notify_store() and
fuse_retrieve()") introduced a loff_t cursor and used it in place of
outarg's offset field. In the min() expression this changed the second
operand from unsigned to signed.

With CONFIG_PROFILE_ALL_BRANCHES, GCC 8 does not propagate the range
established by the preceding MAX_LFS_FILESIZE check through the branch
profiling code. Consequently, min() cannot prove that the signed operand
is nonnegative and rejects the mixed-signedness comparison:

  min(outarg.size, ((loff_t)((long long)(~0ULL >> 1))) - pos)
  signedness error

This happens with GCC 8.1 on x86-64 and GCC 8.5 on arm and s390.
GCC 8.1 remains the minimum supported compiler.

Use umin(), which is intended for comparing an unsigned value with a
signed value that is known to be nonnegative. The preceding bounds check
guarantees that MAX_LFS_FILESIZE - pos is nonnegative, and outarg.size
bounds the result to unsigned int.

Fixes: 25307ca50b815 ("fuse: simplify logic in fuse_notify_store() and fuse_retrieve()")
Cc: stable@vger.kernel.org # v7.1
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Testing:
- Fails without the patch and builds with it: GCC 8.1.0 on x86-64 and
  GCC 8.5.0 on arm and s390, each with CONFIG_PROFILE_ALL_BRANCHES set
- Builds either way on GCC 14 and GCC 15 on x86-64, GCC 15 on s390 and
  Clang 21 on x86-64
- With the preceding bounds check, umin() changes the signed comparison
  to an equivalent unsigned comparison. Instruction counts are unchanged
  on all tested targets
- Reproducer: defconfig plus FUSE_FS, FTRACE, TRACING and
  PROFILE_ALL_BRANCHES, then build fs/fuse/notify.o

Stable backport note: in v7.1 the affected code is in fs/fuse/dev.c

 fs/fuse/notify.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
index 29578104ae6cd..3370ae344f751 100644
--- a/fs/fuse/notify.c
+++ b/fs/fuse/notify.c
@@ -153,7 +153,7 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
 
 	nodeid = outarg.nodeid;
 	pos = outarg.offset;
-	num = min(outarg.size, MAX_LFS_FILESIZE - pos);
+	num = umin(outarg.size, MAX_LFS_FILESIZE - pos);
 
 	down_read(&fc->killsb);
 
-- 
2.53.0

On Tue, 11 Aug 2026 at 21:57, Karl Mehltretter <kmehltretter@gmail.com> wrote:

> Use umin(), which is intended for comparing an unsigned value with a
> signed value that is known to be nonnegative. The preceding bounds check
> guarantees that MAX_LFS_FILESIZE - pos is nonnegative, and outarg.size
> bounds the result to unsigned int.

Applied, thanks.

Miklos

On Tue, Aug 11, 2026 at 09:57:33PM +0100, Karl Mehltretter wrote:
> diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
> index 29578104ae6cd..3370ae344f751 100644
> --- a/fs/fuse/notify.c
> +++ b/fs/fuse/notify.c
> @@ -153,7 +153,7 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
>  
>  	nodeid = outarg.nodeid;
>  	pos = outarg.offset;
> -	num = min(outarg.size, MAX_LFS_FILESIZE - pos);
> +	num = umin(outarg.size, MAX_LFS_FILESIZE - pos);
>  
>  	down_read(&fc->killsb);
>  

Friendly ping on this build fix. Is anything else needed from my side?

Thanks,
Karl

On Tue, Aug 11, 2026 at 09:57:33PM +0100, Karl Mehltretter wrote:
> Fixes: 25307ca50b815 ("fuse: simplify logic in fuse_notify_store() and fuse_retrieve()")
> Cc: stable@vger.kernel.org # v7.1
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Just a friendly ping in case this got missed.

Thanks,
Karl