From ed58108a5d575d925c825898038d544603782950 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 15 Nov 2023 09:37:40 -0500 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...r-buffer-sizes-in-the-tree-search-io.patch | 77 +++++++++++++++++++ queue-6.1/series | 1 + 2 files changed, 78 insertions(+) create mode 100644 queue-6.1/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch diff --git a/queue-6.1/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch b/queue-6.1/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch new file mode 100644 index 00000000000..a052f1f1190 --- /dev/null +++ b/queue-6.1/btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch @@ -0,0 +1,77 @@ +From bab51a93ae1b0179fe5a460e06ae7fab3395fe32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 10:05:48 +0100 +Subject: btrfs: use u64 for buffer sizes in the tree search ioctls + +From: Filipe Manana + +[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ] + +In the tree search v2 ioctl we use the type size_t, which is an unsigned +long, to track the buffer size in the local variable 'buf_size'. An +unsigned long is 32 bits wide on a 32 bits architecture. The buffer size +defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later +try to copy the local variable 'buf_size' to the argument struct, when +the search returns -EOVERFLOW, we copy only 32 bits which will be a +problem on big endian systems. + +Fix this by using a u64 type for the buffer sizes, not only at +btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain +so that we can use the u64 at btrfs_ioctl_tree_search_v2(). + +Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2") +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/ +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ioctl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 9474265ee7ea3..e015e1e025b6e 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2420,7 +2420,7 @@ static noinline int key_in_sk(struct btrfs_key *key, + static noinline int copy_to_sk(struct btrfs_path *path, + struct btrfs_key *key, + struct btrfs_ioctl_search_key *sk, +- size_t *buf_size, ++ u64 *buf_size, + char __user *ubuf, + unsigned long *sk_offset, + int *num_found) +@@ -2552,7 +2552,7 @@ static noinline int copy_to_sk(struct btrfs_path *path, + + static noinline int search_ioctl(struct inode *inode, + struct btrfs_ioctl_search_key *sk, +- size_t *buf_size, ++ u64 *buf_size, + char __user *ubuf) + { + struct btrfs_fs_info *info = btrfs_sb(inode->i_sb); +@@ -2625,7 +2625,7 @@ static noinline int btrfs_ioctl_tree_search(struct inode *inode, + struct btrfs_ioctl_search_args __user *uargs = argp; + struct btrfs_ioctl_search_key sk; + int ret; +- size_t buf_size; ++ u64 buf_size; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; +@@ -2655,8 +2655,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct inode *inode, + struct btrfs_ioctl_search_args_v2 __user *uarg = argp; + struct btrfs_ioctl_search_args_v2 args; + int ret; +- size_t buf_size; +- const size_t buf_limit = SZ_16M; ++ u64 buf_size; ++ const u64 buf_limit = SZ_16M; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; +-- +2.42.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 33173ec0a03..47b1f1d6f9b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -374,3 +374,4 @@ fbdev-imsttfb-fix-error-path-of-imsttfb_probe.patch fbdev-imsttfb-fix-a-resource-leak-in-probe.patch fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch tracing-kprobes-fix-the-order-of-argument-descriptio.patch +btrfs-use-u64-for-buffer-sizes-in-the-tree-search-io.patch -- 2.47.3