diff --git a/backport-enclose-macro-arguments.patch b/backport-enclose-macro-arguments.patch
new file mode 100644
index 0000000000000000000000000000000000000000..b3079f87c88f37256f7c52acd1244f78e14c69b5
--- /dev/null
+++ b/backport-enclose-macro-arguments.patch
@@ -0,0 +1,36 @@
+From 9ba1de39ffcfca6665bdb36116810c445ab88147 Mon Sep 17 00:00:00 2001
+From: jiawenhao <jiawenhao@xfusion.com>
+Date: Mon, 21 Apr 2025 17:01:51 +0800
+Subject: [PATCH] enclose-macro-arguments
+
+---
+ modules/pam_unix/support.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/modules/pam_unix/support.h b/modules/pam_unix/support.h
+index b5712b5..23d77c3 100644
+--- a/modules/pam_unix/support.h
++++ b/modules/pam_unix/support.h
+@@ -31,7 +31,7 @@ typedef struct {
+  * macro to determine if a given flag is on
+  */
+ 
+-#define on(x,ctrl)  (unix_args[x].flag & ctrl)
++#define on(x,ctrl)  (unix_args[x].flag & (ctrl))
+ 
+ /*
+  * macro to determine that a given flag is NOT on
+@@ -43,8 +43,8 @@ typedef struct {
+  * macro to turn on/off a ctrl flag manually
+  */
+ 
+-#define set(x,ctrl)   (ctrl = ((ctrl)&unix_args[x].mask)|unix_args[x].flag)
+-#define unset(x,ctrl) (ctrl &= ~(unix_args[x].flag))
++#define set(x,ctrl)   ((ctrl) = ((ctrl)&unix_args[x].mask)|unix_args[x].flag)
++#define unset(x,ctrl) ((ctrl) &= ~(unix_args[x].flag))
+ 
+ /* the generic mask */
+ 
+-- 
+2.27.0
+
diff --git a/pam.spec b/pam.spec
index 480987f1e5abea884cd70d2c81944d6c28129a7b..ea55ee569a995c6b274cf9db56fa4528b852085a 100644
--- a/pam.spec
+++ b/pam.spec
@@ -4,7 +4,7 @@
 %define _pamconfdir %{_sysconfdir}/pam.d
 Name: pam
 Version: 1.5.3
-Release: 8
+Release: 9
 Summary: Pluggable Authentication Modules for Linux
 License: BSD and GPLv2+
 URL: http://www.linux-pam.org/
@@ -28,6 +28,7 @@ Patch5: backport-CVE-2024-10963.patch
 Patch6: backport-CVE-2024-10041.patch
 Patch7: backport-CVE-2024-10041-pam_unix-try-to-set-uid-to-0-for-unix_chkpwd.patch
 Patch8: backport-libpam-use-close_range-to-close-file-descriptors.patch
+Patch9: backport-enclose-macro-arguments.patch
 
 Patch9000:change-ndbm-to-gdbm.patch
 Patch9001:add-sm3-crypt-support.patch
@@ -182,6 +183,9 @@ make check
 
 
 %changelog
+* Mon Apr 21 2025 jiawenhao <jiawenhao@xfusion.com> - 1.5.3-9
+- backport enclose macro arguments
+
 * Mon Mar 24 2025 hugel <gengqihu2@h-partners.com> - 1.5.3-8
 - backport patch libpam use close_range() to close file descriptors