[3.8.y.z extended stable] Patch "Btrfs: fix access_ok() check in btrfs_ioctl_send()" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    Btrfs: fix access_ok() check in btrfs_ioctl_send()

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.16.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 9637313068dd8b2c913f1487d7ef09c3ba221b8d Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter at oracle.com>
Date: Thu, 10 Jan 2013 03:57:25 -0500
Subject: Btrfs: fix access_ok() check in btrfs_ioctl_send()

commit 700ff4f095d78af0998953e922e041d75254518b upstream.

The closing parenthesis is in the wrong place.  We want to check
"sizeof(*arg->clone_sources) * arg->clone_sources_count" instead of
"sizeof(*arg->clone_sources * arg->clone_sources_count)".

Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Reviewed-by: Jie Liu <jeff.liu at oracle.com>
Signed-off-by: Chris Mason <clm at fb.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 fs/btrfs/send.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 321b7fb..a89d788 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -4555,8 +4555,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
 	}

 	if (!access_ok(VERIFY_READ, arg->clone_sources,
-			sizeof(*arg->clone_sources *
-			arg->clone_sources_count))) {
+			sizeof(*arg->clone_sources) *
+			arg->clone_sources_count)) {
 		ret = -EFAULT;
 		goto out;
 	}
--
1.8.3.2