btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl
authorDan Carpenter <dancarpenter@oracle.com>
Wed, 17 Feb 2021 06:04:34 +0000 (09:04 +0300)
committerDavid Sterba <dsterba@suse.com>
Tue, 2 Mar 2021 15:55:47 +0000 (16:55 +0100)
commit5011c5a663b9c6d6aff3d394f11049b371199627
tree30158953f67cebabb9db0535a9c37e1c0f4c03f5
parent4f6a49de64fd1b1dba5229c02047376da7cf24fd
btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl

The problem is we're copying "inherit" from user space but we don't
necessarily know that we're copying enough data for a 64 byte
struct.  Then the next problem is that 'inherit' has a variable size
array at the end, and we have to verify that array is the size we
expected.

Fixes: 6f72c7e20dba ("Btrfs: add qgroup inheritance")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
fs/btrfs/ioctl.c