btrfs: tree_search, search_ioctl: accept varying buffer

rewrite search_ioctl to accept a buffer with varying size

Signed-off-by: Gerhard Heift <Gerhard@Heift.Name>
Signed-off-by: Chris Mason <clm@fb.com>
Acked-by: David Sterba <dsterba@suse.cz>

1 files changed, 11 insertions, 7 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 65148cd102cd..775640475e35 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1957,6 +1957,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                                struct btrfs_path *path,
                                struct btrfs_key *key,
                                struct btrfs_ioctl_search_key *sk,
+                               size_t buf_size,
                                char *buf,
                                unsigned long *sk_offset,
                                int *num_found)
@@ -1989,11 +1990,10 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                 if (!key_in_sk(key, sk))
                         continue;
 
-                if (sizeof(sh) + item_len > BTRFS_SEARCH_ARGS_BUFSIZE)
+                if (sizeof(sh) + item_len > buf_size)
                         item_len = 0;
 
-                if (sizeof(sh) + item_len + *sk_offset >
-                    BTRFS_SEARCH_ARGS_BUFSIZE) {
+                if (sizeof(sh) + item_len + *sk_offset > buf_size) {
                         ret = 1;
                         goto out;
                 }
@@ -2040,17 +2040,21 @@ out:
 }
 
 static noinline int search_ioctl(struct inode *inode,
-                                 struct btrfs_ioctl_search_args *args)
+                                 struct btrfs_ioctl_search_key *sk,
+                                 size_t buf_size,
+                                 char *buf)
 {
         struct btrfs_root *root;
         struct btrfs_key key;
         struct btrfs_path *path;
-        struct btrfs_ioctl_search_key *sk = &args->key;
         struct btrfs_fs_info *info = BTRFS_I(inode)->root->fs_info;
         int ret;
         int num_found = 0;
         unsigned long sk_offset = 0;
 
+        if (buf_size < sizeof(struct btrfs_ioctl_search_header))
+                return -EOVERFLOW;
+
         path = btrfs_alloc_path();
         if (!path)
                 return -ENOMEM;
@@ -2084,7 +2088,7 @@ static noinline int search_ioctl(struct inode *inode,
                                 ret = 0;
                         goto err;
                 }
-                ret = copy_to_sk(root, path, &key, sk, args->buf,
+                ret = copy_to_sk(root, path, &key, sk, buf_size, buf,
                                  &sk_offset, &num_found);
                 btrfs_release_path(path);
                 if (ret)
@@ -2113,7 +2117,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
                 return PTR_ERR(args);
 
         inode = file_inode(file);
-        ret = search_ioctl(inode, args);
+        ret = search_ioctl(inode, &args->key, sizeof(args->buf), args->buf);
         if (ret == 0 && copy_to_user(argp, args, sizeof(*args)))
                 ret = -EFAULT;
         kfree(args);