| From 7004fc6d7a28002a69417c746aa3ca3302ac84e3 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 15 Dec 2023 10:01:44 -0500 |
| Subject: btrfs: do not allow non subvolume root targets for snapshot |
| |
| From: Josef Bacik <josef@toxicpanda.com> |
| |
| [ Upstream commit a8892fd71933126ebae3d60aec5918d4dceaae76 ] |
| |
| Our btrfs subvolume snapshot <source> <destination> utility enforces |
| that <source> is the root of the subvolume, however this isn't enforced |
| in the kernel. Update the kernel to also enforce this limitation to |
| avoid problems with other users of this ioctl that don't have the |
| appropriate checks in place. |
| |
| Reported-by: Martin Michaelis <code@mgjm.de> |
| CC: stable@vger.kernel.org # 4.14+ |
| Reviewed-by: Neal Gompa <neal@gompa.dev> |
| Signed-off-by: Josef Bacik <josef@toxicpanda.com> |
| Reviewed-by: David Sterba <dsterba@suse.com> |
| Signed-off-by: David Sterba <dsterba@suse.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/btrfs/ioctl.c | 9 +++++++++ |
| 1 file changed, 9 insertions(+) |
| |
| diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c |
| index 1575992d1f14c..9f1efd5c24f1a 100644 |
| --- a/fs/btrfs/ioctl.c |
| +++ b/fs/btrfs/ioctl.c |
| @@ -1847,6 +1847,15 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file, |
| * are limited to own subvolumes only |
| */ |
| ret = -EPERM; |
| + } else if (btrfs_ino(BTRFS_I(src_inode)) != BTRFS_FIRST_FREE_OBJECTID) { |
| + /* |
| + * Snapshots must be made with the src_inode referring |
| + * to the subvolume inode, otherwise the permission |
| + * checking above is useless because we may have |
| + * permission on a lower directory but not the subvol |
| + * itself. |
| + */ |
| + ret = -EINVAL; |
| } else { |
| ret = btrfs_mksubvol(&file->f_path, name, namelen, |
| BTRFS_I(src_inode)->root, |
| -- |
| 2.43.0 |
| |
