1 files changed, 41 insertions, 21 deletions

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 8d358c547c59..6a8c86074aa4 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5939,6 +5939,7 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
         u32 i;
         u64 *clone_sources_tmp = NULL;
         int clone_sources_to_rollback = 0;
+        unsigned alloc_size;
         int sort_clone_roots = 0;
         int index;
 
@@ -5978,6 +5979,12 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                 goto out;
         }
 
+        if (arg->clone_sources_count >
+            ULLONG_MAX / sizeof(*arg->clone_sources)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         if (!access_ok(VERIFY_READ, arg->clone_sources,
                         sizeof(*arg->clone_sources) *
                         arg->clone_sources_count)) {
@@ -6022,40 +6029,53 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
         sctx->clone_roots_cnt = arg->clone_sources_count;
 
         sctx->send_max_size = BTRFS_SEND_BUF_SIZE;
-        sctx->send_buf = vmalloc(sctx->send_max_size);
+        sctx->send_buf = kmalloc(sctx->send_max_size, GFP_KERNEL | __GFP_NOWARN);
         if (!sctx->send_buf) {
-                ret = -ENOMEM;
-                goto out;
+                sctx->send_buf = vmalloc(sctx->send_max_size);
+                if (!sctx->send_buf) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
         }
 
-        sctx->read_buf = vmalloc(BTRFS_SEND_READ_SIZE);
+        sctx->read_buf = kmalloc(BTRFS_SEND_READ_SIZE, GFP_KERNEL | __GFP_NOWARN);
         if (!sctx->read_buf) {
-                ret = -ENOMEM;
-                goto out;
+                sctx->read_buf = vmalloc(BTRFS_SEND_READ_SIZE);
+                if (!sctx->read_buf) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
         }
 
         sctx->pending_dir_moves = RB_ROOT;
         sctx->waiting_dir_moves = RB_ROOT;
         sctx->orphan_dirs = RB_ROOT;
 
-        sctx->clone_roots = vzalloc(sizeof(struct clone_root) *
-                        (arg->clone_sources_count + 1));
+        alloc_size = sizeof(struct clone_root) * (arg->clone_sources_count + 1);
+
+        sctx->clone_roots = kzalloc(alloc_size, GFP_KERNEL | __GFP_NOWARN);
         if (!sctx->clone_roots) {
-                ret = -ENOMEM;
-                goto out;
+                sctx->clone_roots = vzalloc(alloc_size);
+                if (!sctx->clone_roots) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
         }
 
+        alloc_size = arg->clone_sources_count * sizeof(*arg->clone_sources);
+
         if (arg->clone_sources_count) {
-                clone_sources_tmp = vmalloc(arg->clone_sources_count *
-                                sizeof(*arg->clone_sources));
+                clone_sources_tmp = kmalloc(alloc_size, GFP_KERNEL | __GFP_NOWARN);
                 if (!clone_sources_tmp) {
-                        ret = -ENOMEM;
-                        goto out;
+                        clone_sources_tmp = vmalloc(alloc_size);
+                        if (!clone_sources_tmp) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                 }
 
                 ret = copy_from_user(clone_sources_tmp, arg->clone_sources,
-                                arg->clone_sources_count *
-                                sizeof(*arg->clone_sources));
+                                alloc_size);
                 if (ret) {
                         ret = -EFAULT;
                         goto out;
@@ -6089,7 +6109,7 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                         sctx->clone_roots[i].root = clone_root;
                         clone_sources_to_rollback = i + 1;
                 }
-                vfree(clone_sources_tmp);
+                kvfree(clone_sources_tmp);
                 clone_sources_tmp = NULL;
         }
 
@@ -6207,15 +6227,15 @@ out:
                 btrfs_root_dec_send_in_progress(sctx->parent_root);
 
         kfree(arg);
-        vfree(clone_sources_tmp);
+        kvfree(clone_sources_tmp);
 
         if (sctx) {
                 if (sctx->send_filp)
                         fput(sctx->send_filp);
 
-                vfree(sctx->clone_roots);
-                vfree(sctx->send_buf);
-                vfree(sctx->read_buf);
+                kvfree(sctx->clone_roots);
+                kvfree(sctx->send_buf);
+                kvfree(sctx->read_buf);
 
                 name_cache_free(sctx);