David SterbaandGreg Kroah-Hartman 6195cea4c7 btrfs: send: limit number of clones and allocated memory size ...

[ Upstream commit 33e17b3f5a ]

The arg->clone_sources_count is u64 and can trigger a warning when a
huge value is passed from user space and a huge array is allocated.
Limit the allocated memory to 8MiB (can be increased if needed), which
in turn limits the number of clone sources to 8M / sizeof(struct
clone_root) = 8M / 40 = 209715.  Real world number of clones is from
tens to hundreds, so this is future proof.

Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-03-03 11:44:50 +01:00

..

tests

btrfs: remove pointless and double ulist frees in error paths of qgroup tests

2022-11-25 17:45:40 +01:00

acl.c

…

async-thread.c

btrfs: fix memory ordering between normal and ordered work functions

2021-11-26 10:39:20 +01:00

async-thread.h

…

backref.c

btrfs: fix resolving backrefs for inline extent followed by prealloc

2023-01-14 10:16:30 +01:00

backref.h

btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino

2022-12-08 11:23:53 +01:00

block-group.c

btrfs: reset block group chunk force if we have to wait

2022-08-21 15:16:20 +02:00

block-group.h

…

block-rsv.c

…

block-rsv.h

…

btrfs_inode.h

…

check-integrity.c

…

check-integrity.h

…

compression.c

…

compression.h

…

ctree.c

btrfs: check the root node for uptodate before returning it

2022-01-27 10:54:27 +01:00

ctree.h

…

delalloc-space.c

…

delalloc-space.h

…

delayed-inode.c

…

delayed-inode.h

…

delayed-ref.c

…

delayed-ref.h

…

dev-replace.c

btrfs: add info when mount fails due to stale replace target

2022-08-31 17:15:22 +02:00

dev-replace.h

…

dir-item.c

…

discard.c

…

discard.h

…

disk-io.c

btrfs: fix hang during unmount when stopping a space reclaim worker

2022-10-05 10:38:37 +02:00

disk-io.h

…

export.c

btrfs: fix type of parameter generation in btrfs_get_dentry

2022-11-10 18:14:25 +01:00

export.h

btrfs: fix type of parameter generation in btrfs_get_dentry

2022-11-10 18:14:25 +01:00

extent_io.c

btrfs: clear extent buffer uptodate when we fail to write it

2021-12-14 11:32:38 +01:00

extent_io.h

btrfs: fix qgroup reserve overflow the qgroup limit

2022-04-13 21:01:08 +02:00

extent_map.c

…

extent_map.h

…

extent-io-tree.h

…

extent-tree.c

btrfs: always report error in run_one_delayed_ref()

2023-01-24 07:19:56 +01:00

file-item.c

btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling

2021-10-09 14:40:56 +02:00

file.c

btrfs: fix fallocate to use file_modified to update permissions consistently

2022-04-20 09:23:19 +02:00

free-space-cache.c

…

free-space-cache.h

…

free-space-tree.c

…

free-space-tree.h

…

inode-item.c

…

inode-map.c

…

inode-map.h

…

inode.c

btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents

2022-07-21 21:20:01 +02:00

ioctl.c

btrfs: replace strncpy() with strscpy()

2023-01-14 10:16:40 +01:00

Kconfig

…

locking.c

…

locking.h

…

lzo.c

…

Makefile

…

misc.h

…

ordered-data.c

…

ordered-data.h

…

orphan.c

…

print-tree.c

…

print-tree.h

…

props.c

…

props.h

…

qgroup.c

btrfs: fix race between quota rescan and disable leading to NULL pointer deref

2023-01-24 07:19:59 +01:00

qgroup.h

…

raid56.c

btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()

2022-08-21 15:16:27 +02:00

raid56.h

…

rcu-string.h

btrfs: replace strncpy() with strscpy()

2023-01-14 10:16:40 +01:00

reada.c

…

ref-verify.c

…

ref-verify.h

…

reflink.c

btrfs: fix unexpected error path when reflinking an inline extent

2022-04-08 14:40:04 +02:00

reflink.h

…

relocation.c

…

root-tree.c

btrfs: fix silent failure when deleting root reference

2022-08-31 17:15:21 +02:00

scrub.c

btrfs: scrub: try to fix super block errors

2022-10-26 13:25:51 +02:00

send.c

btrfs: send: limit number of clones and allocated memory size

2023-03-03 11:44:50 +01:00

send.h

…

space-info.c

btrfs: prevent __btrfs_dump_space_info() to underflow its free space

2021-09-30 10:11:00 +02:00

space-info.h

…

struct-funcs.c

…

super.c

btrfs: add error messages to all unrecognized mount options

2022-06-29 08:59:45 +02:00

sysfs.c

btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()

2022-12-02 17:40:06 +01:00

sysfs.h

…

transaction.c

…

transaction.h

…

tree-checker.c

btrfs: tree-checker: check item_size for dev_item

2022-03-02 11:42:45 +01:00

tree-checker.h

…

tree-defrag.c

…

tree-log.c

btrfs: fix lost error handling when looking up extended ref on log replay

2022-08-25 11:37:51 +02:00

tree-log.h

…

ulist.c

…

ulist.h

…

uuid-tree.c

…

volumes.c

btrfs: free device in btrfs_close_devices for a single device filesystem

2023-02-15 17:22:26 +01:00

volumes.h

…

xattr.c

btrfs: check if root is readonly while setting security xattr

2022-08-31 17:15:22 +02:00

xattr.h

…

zlib.c

btrfs: zlib: zero-initialize zlib workspace

2023-02-15 17:22:22 +01:00

zstd.c

…