btrfs: send: use vmalloc only as fallback for send_buf

[karo-tx-linux.git] / fs / btrfs / send.c

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 8d358c547c59fd8d010d27cf1180a04d51be5fe5..b6e2c6ec4ee5a7e9c44363584c872b2547b80f6a 100644 (file)
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5978,6 +5978,12 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                goto out;
        }
 
+       if (arg->clone_sources_count >
+           ULLONG_MAX / sizeof(*arg->clone_sources)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        if (!access_ok(VERIFY_READ, arg->clone_sources,
                        sizeof(*arg->clone_sources) *
                        arg->clone_sources_count)) {
@@ -6022,10 +6028,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
        sctx->clone_roots_cnt = arg->clone_sources_count;
 
        sctx->send_max_size = BTRFS_SEND_BUF_SIZE;
-       sctx->send_buf = vmalloc(sctx->send_max_size);
+       sctx->send_buf = kmalloc(sctx->send_max_size, GFP_KERNEL | __GFP_NOWARN);
        if (!sctx->send_buf) {
-               ret = -ENOMEM;
-               goto out;
+               sctx->send_buf = vmalloc(sctx->send_max_size);
+               if (!sctx->send_buf) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
        }
 
        sctx->read_buf = vmalloc(BTRFS_SEND_READ_SIZE);
@@ -6214,7 +6223,7 @@ out:
                        fput(sctx->send_filp);
 
                vfree(sctx->clone_roots);
-               vfree(sctx->send_buf);
+               kvfree(sctx->send_buf);
                vfree(sctx->read_buf);
 
                name_cache_free(sctx);