Patch "Btrfs: fix an integer overflow check" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

Btrfs: fix an integer overflow check

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
btrfs-fix-an-integer-overflow-check.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Fri, 17 Mar 2017 23:51:20 +0300
Subject: Btrfs: fix an integer overflow check

From: Dan Carpenter <[email protected]>

[ Upstream commit 457ae7268b29c33dee1c0feb143a15f6029d177b ]

This isn't super serious because you need CAP_ADMIN to run this code.

I added this integer overflow check last year but apparently I am rubbish at writing integer overflow checks... There are two issues. First, access_ok() works on unsigned long type and not u64 so on 32 bit systems the access_ok() could be checking a truncated size. The other issue is that we should be using a stricter limit so we don't overflow the kzalloc() setting ctx->clone_roots later in the function after the access_ok():

	alloc_size = sizeof(struct clone_root) * (arg->clone_sources_count + 1);
	sctx->clone_roots = kzalloc(alloc_size, GFP_KERNEL | __GFP_NOWARN);

---
 fs/btrfs/send.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -6196,8 +6196,13 @@ long btrfs_ioctl_send(struct file *mnt_f
 		goto out;
 	}
 
+	/*
+	 * Check that we don't overflow at later allocations, we request
+	 * clone_sources_count + 1 items, and compare to unsigned long inside
+	 * access_ok.
+	 */
 	if (arg->clone_sources_count >
-	    ULLONG_MAX / sizeof(*arg->clone_sources)) {
+	    ULONG_MAX / sizeof(struct clone_root) - 1) {
 		ret = -EINVAL;
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/bna-integer-overflow-bug-in-debugfs.patch queue-4.9/btrfs-fix-an-integer-overflow-check.patch queue-4.9/ib-rxe-double-free-on-error.patch