1 files changed, 6 insertions, 1 deletions

diff --git a/fs/dax.c b/fs/dax.c
index 761495bf5eb9..e207f8f9b700 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -208,7 +208,12 @@ static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
                                 dax.addr += first;
                                 size = map_len - first;
                         }
-                        max = min(pos + size, end);
+                        /*
+                         * pos + size is one past the last offset for IO,
+                         * so pos + size can overflow loff_t at extreme offsets.
+                         * Cast to u64 to catch this and get the true minimum.
+                         */
+                        max = min_t(u64, pos + size, end);
                 }
 
                 if (iov_iter_rw(iter) == WRITE) {