Fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch b/queue-4.14/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch
new file mode 100644 (file)
index 0000000..fe69ae4
--- /dev/null
+++ b/queue-4.14/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch
@@ -0,0 +1,77 @@
+From a765589747496a2ae6acee995aeed875f60a08f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 10:05:48 +0100
+Subject: btrfs: use u64 for buffer sizes in the tree search ioctls
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ]
+
+In the tree search v2 ioctl we use the type size_t, which is an unsigned
+long, to track the buffer size in the local variable 'buf_size'. An
+unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
+defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
+try to copy the local variable 'buf_size' to the argument struct, when
+the search returns -EOVERFLOW, we copy only 32 bits which will be a
+problem on big endian systems.
+
+Fix this by using a u64 type for the buffer sizes, not only at
+btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
+so that we can use the u64 at btrfs_ioctl_tree_search_v2().
+
+Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ioctl.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index d8255bd33d50a..93b83dc298ac9 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1988,7 +1988,7 @@ static noinline int key_in_sk(struct btrfs_key *key,
+ static noinline int copy_to_sk(struct btrfs_path *path,
+                              struct btrfs_key *key,
+                              struct btrfs_ioctl_search_key *sk,
+-                             size_t *buf_size,
++                             u64 *buf_size,
+                              char __user *ubuf,
+                              unsigned long *sk_offset,
+                              int *num_found)
+@@ -2120,7 +2120,7 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+ 
+ static noinline int search_ioctl(struct inode *inode,
+                                struct btrfs_ioctl_search_key *sk,
+-                               size_t *buf_size,
++                               u64 *buf_size,
+                                char __user *ubuf)
+ {
+       struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
+@@ -2192,7 +2192,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
+       struct btrfs_ioctl_search_key sk;
+       struct inode *inode;
+       int ret;
+-      size_t buf_size;
++      u64 buf_size;
+ 
+       if (!capable(CAP_SYS_ADMIN))
+               return -EPERM;
+@@ -2226,8 +2226,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
+       struct btrfs_ioctl_search_args_v2 args;
+       struct inode *inode;
+       int ret;
+-      size_t buf_size;
+-      const size_t buf_limit = SZ_16M;
++      u64 buf_size;
++      const u64 buf_limit = SZ_16M;
+ 
+       if (!capable(CAP_SYS_ADMIN))
+               return -EPERM;
+-- 
+2.42.0
+

diff --git a/queue-4.14/series b/queue-4.14/series
index 109ad0918ce8afa0cccb132fd6ff435c18334682..ae82bd29b4c36c85e21d350c0f3901df1108d582 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -41,3 +41,4 @@ dccp-tcp-call-security_inet_conn_request-after-setti.patch
 tg3-power-down-device-only-on-system_power_off.patch
 netfilter-xt_recent-fix-increase-ipv6-literal-buffer.patch
 fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch
+btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch