1 files changed, 15 insertions, 9 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 6e09fc1c1c18..3d89fd888399 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1957,7 +1957,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                                struct btrfs_path *path,
                                struct btrfs_key *key,
                                struct btrfs_ioctl_search_key *sk,
-                               size_t buf_size,
+                               size_t *buf_size,
                                char *buf,
                                unsigned long *sk_offset,
                                int *num_found)
@@ -1990,7 +1990,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                 if (!key_in_sk(key, sk))
                         continue;
 
-                if (sizeof(sh) + item_len > buf_size) {
+                if (sizeof(sh) + item_len > *buf_size) {
                         if (*num_found) {
                                 ret = 1;
                                 goto out;
@@ -2001,11 +2001,12 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                          * handle -EOVERFLOW
                          */
 
+                        *buf_size = sizeof(sh) + item_len;
                         item_len = 0;
                         ret = -EOVERFLOW;
                 }
 
-                if (sizeof(sh) + item_len + *sk_offset > buf_size) {
+                if (sizeof(sh) + item_len + *sk_offset > *buf_size) {
                         ret = 1;
                         goto out;
                 }
@@ -2056,7 +2057,7 @@ out:
 
 static noinline int search_ioctl(struct inode *inode,
                                  struct btrfs_ioctl_search_key *sk,
-                                 size_t buf_size,
+                                 size_t *buf_size,
                                  char *buf)
 {
         struct btrfs_root *root;
@@ -2067,8 +2068,10 @@ static noinline int search_ioctl(struct inode *inode,
         int num_found = 0;
         unsigned long sk_offset = 0;
 
-        if (buf_size < sizeof(struct btrfs_ioctl_search_header))
+        if (*buf_size < sizeof(struct btrfs_ioctl_search_header)) {
+                *buf_size = sizeof(struct btrfs_ioctl_search_header);
                 return -EOVERFLOW;
+        }
 
         path = btrfs_alloc_path();
         if (!path)
@@ -2121,9 +2124,10 @@ err:
 static noinline int btrfs_ioctl_tree_search(struct file *file,
                                            void __user *argp)
 {
-         struct btrfs_ioctl_search_args *args;
-         struct inode *inode;
-         int ret;
+        struct btrfs_ioctl_search_args *args;
+        struct inode *inode;
+        int ret;
+        size_t buf_size;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -2132,8 +2136,10 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
         if (IS_ERR(args))
                 return PTR_ERR(args);
 
+        buf_size = sizeof(args->buf);
+
         inode = file_inode(file);
-        ret = search_ioctl(inode, &args->key, sizeof(args->buf), args->buf);
+        ret = search_ioctl(inode, &args->key, &buf_size, args->buf);
 
         /*
          * In the origin implementation an overflow is handled by returning a