CVE-2026-72367: iomap: guard io_size EOF trim against concurrent truncate underflow

In the Linux kernel, the following vulnerability has been resolved:

iomap: guard iosize EOF trim against concurrent truncate underflow

iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that iosize tracks only valid data within EOF. This trims iosize when a writeback range extends past endpos:

ioend->iosize += maplen; if (ioend->iooffset + ioend->iosize > endpos) ioend->iosize = endpos - ioend->iooffset;

However, if endpos ends up below ioend->iooffset, the subtraction becomes negative and is stored in sizet iosize, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after endpos was sampled in iomapwritebackhandleeof().

A wrapped iosize can mislead append detection and corrupt completion-time size handling, since filesystem endio paths consume iosize for decisions such as on-disk EOF updates and unwritten/COW completion ranges.

Fix this by clamping iosize to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming iosize to valid in-EOF data while avoiding the underflow.