Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch b/queue-5.10/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch
new file mode 100644 (file)
index 0000000..1c550d4
--- /dev/null
+++ b/queue-5.10/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch
@@ -0,0 +1,77 @@
+From 8151fc6bf910bf1fec541ce46de7ff449787ed16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 10:05:48 +0100
+Subject: btrfs: use u64 for buffer sizes in the tree search ioctls
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ]
+
+In the tree search v2 ioctl we use the type size_t, which is an unsigned
+long, to track the buffer size in the local variable 'buf_size'. An
+unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
+defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
+try to copy the local variable 'buf_size' to the argument struct, when
+the search returns -EOVERFLOW, we copy only 32 bits which will be a
+problem on big endian systems.
+
+Fix this by using a u64 type for the buffer sizes, not only at
+btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
+so that we can use the u64 at btrfs_ioctl_tree_search_v2().
+
+Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ioctl.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index cffd149faf639..6da8587e2ae37 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2104,7 +2104,7 @@ static noinline int key_in_sk(struct btrfs_key *key,
+ static noinline int copy_to_sk(struct btrfs_path *path,
+                              struct btrfs_key *key,
+                              struct btrfs_ioctl_search_key *sk,
+-                             size_t *buf_size,
++                             u64 *buf_size,
+                              char __user *ubuf,
+                              unsigned long *sk_offset,
+                              int *num_found)
+@@ -2236,7 +2236,7 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+ 
+ static noinline int search_ioctl(struct inode *inode,
+                                struct btrfs_ioctl_search_key *sk,
+-                               size_t *buf_size,
++                               u64 *buf_size,
+                                char __user *ubuf)
+ {
+       struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
+@@ -2306,7 +2306,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
+       struct btrfs_ioctl_search_key sk;
+       struct inode *inode;
+       int ret;
+-      size_t buf_size;
++      u64 buf_size;
+ 
+       if (!capable(CAP_SYS_ADMIN))
+               return -EPERM;
+@@ -2340,8 +2340,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
+       struct btrfs_ioctl_search_args_v2 args;
+       struct inode *inode;
+       int ret;
+-      size_t buf_size;
+-      const size_t buf_limit = SZ_16M;
++      u64 buf_size;
++      const u64 buf_limit = SZ_16M;
+ 
+       if (!capable(CAP_SYS_ADMIN))
+               return -EPERM;
+-- 
+2.42.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index f0cf4c042c7293fdf91074b8b5dfad47ad6e1971..8f3328156814dccdb44684501f6555fc2e3249fa 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -203,3 +203,4 @@ fbdev-imsttfb-fix-error-path-of-imsttfb_probe.patch
 fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
 fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch
 tracing-kprobes-fix-the-order-of-argument-descriptio.patch
+btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch