1 files changed, 14 insertions, 9 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index ac37040e426a..b793d112d1f6 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2054,29 +2054,34 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)
 
 static long btrfs_ioctl_fs_info(struct btrfs_root *root, void __user *arg)
 {
-        struct btrfs_ioctl_fs_info_args fi_args;
+        struct btrfs_ioctl_fs_info_args *fi_args;
         struct btrfs_device *device;
         struct btrfs_device *next;
         struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices;
+        int ret = 0;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        fi_args.num_devices = fs_devices->num_devices;
-        fi_args.max_id = 0;
-        memcpy(&fi_args.fsid, root->fs_info->fsid, sizeof(fi_args.fsid));
+        fi_args = kzalloc(sizeof(*fi_args), GFP_KERNEL);
+        if (!fi_args)
+                return -ENOMEM;
+
+        fi_args->num_devices = fs_devices->num_devices;
+        memcpy(&fi_args->fsid, root->fs_info->fsid, sizeof(fi_args->fsid));
 
         mutex_lock(&fs_devices->device_list_mutex);
         list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
-                if (device->devid > fi_args.max_id)
-                        fi_args.max_id = device->devid;
+                if (device->devid > fi_args->max_id)
+                        fi_args->max_id = device->devid;
         }
         mutex_unlock(&fs_devices->device_list_mutex);
 
-        if (copy_to_user(arg, &fi_args, sizeof(fi_args)))
-                return -EFAULT;
+        if (copy_to_user(arg, fi_args, sizeof(*fi_args)))
+                ret = -EFAULT;
 
-        return 0;
+        kfree(fi_args);
+        return ret;
 }
 
 static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg)