kmalloc a few large stack objects in the btrfs_ioctl path

Signed-off-by: Chris Mason <chris.mason@oracle.com>

1 files changed, 14 insertions, 6 deletions

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 585f279..7f76445 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -80,10 +80,14 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
 	int ret = 0;
 	int level;
 	struct btrfs_key first_key;
-	struct btrfs_root new_root;
+	struct btrfs_root *new_root;
 
-	memcpy(&new_root, root, sizeof(new_root));
-	new_root.root_key.objectid = new_root_objectid;
+	new_root = kmalloc(sizeof(*new_root), GFP_NOFS);
+	if (!new_root)
+		return -ENOMEM;
+
+	memcpy(new_root, root, sizeof(*new_root));
+	new_root->root_key.objectid = new_root_objectid;
 
 	WARN_ON(root->ref_cows && trans->transid !=
 		root->fs_info->running_transaction->transid);
@@ -99,12 +103,14 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
 	} else {
 		first_key.objectid = 0;
 	}
-	cow = __btrfs_alloc_free_block(trans, &new_root, buf->len,
+	cow = __btrfs_alloc_free_block(trans, new_root, buf->len,
 				       new_root_objectid,
 				       trans->transid, first_key.objectid,
 				       level, buf->start, 0);
-	if (IS_ERR(cow))
+	if (IS_ERR(cow)) {
+		kfree(new_root);
 		return PTR_ERR(cow);
+	}
 
 	copy_extent_buffer(cow, buf, 0, 0, cow->len);
 	btrfs_set_header_bytenr(cow, cow->start);
@@ -112,7 +118,9 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
 	btrfs_set_header_owner(cow, new_root_objectid);
 
 	WARN_ON(btrfs_header_generation(buf) > trans->transid);
-	ret = btrfs_inc_ref(trans, &new_root, buf);
+	ret = btrfs_inc_ref(trans, new_root, buf);
+	kfree(new_root);
+
 	if (ret)
 		return ret;