diff --git a/patches.suse/ceph-stop-copying-to-iter-at-EOF-on-sync-reads.patch b/patches.suse/ceph-stop-copying-to-iter-at-EOF-on-sync-reads.patch
new file mode 100644
index 0000000..abb7bc0
--- /dev/null
+++ b/patches.suse/ceph-stop-copying-to-iter-at-EOF-on-sync-reads.patch
@@ -0,0 +1,70 @@
+From: Xiubo Li <xiubli@redhat.com>
+Date: Wed, 21 Feb 2024 09:16:12 +0800
+Subject: ceph: stop copying to iter at EOF on sync reads
+Git-commit: 1065da21e5df9d843d2c5165d5d576be000142a6
+Patch-mainline: v6.9-rc1
+References: bsc#1223068
+
+If EOF is encountered, ceph_sync_read() return value is adjusted down
+according to i_size, but the "to" iter is advanced by the actual number
+of bytes read.  Then, when retrying, the remainder of the range may be
+skipped incorrectly.
+
+Ensure that the "to" iter is advanced only until EOF.
+
+[ idryomov: changelog ]
+
+Fixes: c3d8e0b5de48 ("ceph: return the real size read when it hits EOF")
+Reported-by: Frank Hsiao <frankhsiao@qnap.com>
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Frank Hsiao <frankhsiao@qnap.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.de>
+
+---
+ fs/ceph/file.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index abe8028d95bf..3d1cd079dbf1 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1138,7 +1138,12 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos,
+ 		}
+ 
+ 		idx = 0;
+-		left = ret > 0 ? ret : 0;
++		if (ret <= 0)
++			left = 0;
++		else if (off + ret > i_size)
++			left = i_size - off;
++		else
++			left = ret;
+ 		while (left > 0) {
+ 			size_t plen, copied;
+ 
+@@ -1167,15 +1172,13 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos,
+ 	}
+ 
+ 	if (ret > 0) {
+-		if (off > *ki_pos) {
+-			if (off >= i_size) {
+-				*retry_op = CHECK_EOF;
+-				ret = i_size - *ki_pos;
+-				*ki_pos = i_size;
+-			} else {
+-				ret = off - *ki_pos;
+-				*ki_pos = off;
+-			}
++		if (off >= i_size) {
++			*retry_op = CHECK_EOF;
++			ret = i_size - *ki_pos;
++			*ki_pos = i_size;
++		} else {
++			ret = off - *ki_pos;
++			*ki_pos = off;
+ 		}
+ 
+ 		if (last_objver)
+
diff --git a/series.conf b/series.conf
index 3388a77..1bc183b 100644
--- a/series.conf
+++ b/series.conf
@@ -46132,6 +46132,7 @@
 	patches.suse/drm-amd-display-Return-the-correct-HDCP-error-code.patch
 	patches.suse/spi-lm70llp-fix-links-in-doc-and-comments.patch
 	patches.suse/spi-spi-mt65xx-Fix-NULL-pointer-access-in-interrupt-.patch
+	patches.suse/ceph-stop-copying-to-iter-at-EOF-on-sync-reads.patch
 	patches.suse/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch
 	patches.suse/x86-fpu-Keep-xfd_state-in-sync-with-MSR_IA32_XFD.patch
 	patches.suse/0001-mm-page_owner-fix-recursion.patch