Integer overflow in the btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFSIOCCLONERANGE ioctl call.

Description of problem: If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file.

Upstream commit: http://git.kernel.org/linus/1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONEIO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.