diff options
| author | Josef Bacik <josef@toxicpanda.com> | 2023-12-15 10:01:44 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-08 11:29:45 +0100 |
| commit | 04c22233447d70a6a6605c6d780760e75f947923 (patch) | |
| tree | 2058d71023556a6027ac6900706553ddfe39bff2 | |
| parent | 3230a69e663ba554641d68f99e0a4f6fe91c525f (diff) | |
| download | linux-04c22233447d70a6a6605c6d780760e75f947923.tar.gz linux-04c22233447d70a6a6605c6d780760e75f947923.tar.bz2 linux-04c22233447d70a6a6605c6d780760e75f947923.zip | |
btrfs: do not allow non subvolume root targets for snapshot
[ Upstream commit a8892fd71933126ebae3d60aec5918d4dceaae76 ]
Our btrfs subvolume snapshot <source> <destination> utility enforces
that <source> is the root of the subvolume, however this isn't enforced
in the kernel. Update the kernel to also enforce this limitation to
avoid problems with other users of this ioctl that don't have the
appropriate checks in place.
Reported-by: Martin Michaelis <code@mgjm.de>
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/btrfs/ioctl.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 1575992d1f14..9f1efd5c24f1 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -1847,6 +1847,15 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file, * are limited to own subvolumes only */ ret = -EPERM; + } else if (btrfs_ino(BTRFS_I(src_inode)) != BTRFS_FIRST_FREE_OBJECTID) { + /* + * Snapshots must be made with the src_inode referring + * to the subvolume inode, otherwise the permission + * checking above is useless because we may have + * permission on a lower directory but not the subvol + * itself. + */ + ret = -EINVAL; } else { ret = btrfs_mksubvol(&file->f_path, name, namelen, BTRFS_I(src_inode)->root, |