On Fri, Dec 15, 2023 at 10:02 AM Josef Bacik <josef@xxxxxxxxxxxxxx> wrote:
>
> Our btrfs subvolume snapshot <source> <destination> utility enforces
> that <source> is the root of the subvolume, however this isn't enforced
> in the kernel. Update the kernel to also enforce this limitation to
> avoid problems with other users of this ioctl that don't have the
> appropriate checks in place.
>
> cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
> fs/btrfs/ioctl.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 4e50b62db2a8..298edca43901 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -1290,6 +1290,16 @@ static noinline int __btrfs_ioctl_snap_create(struct file *file,
> * are limited to own subvolumes only
> */
> ret = -EPERM;
> + } else if (btrfs_ino(BTRFS_I(src_inode)) !=
> + BTRFS_FIRST_FREE_OBJECTID) {
> + /*
> + * Snapshots must be made with the src_inode referring
> + * to the subvolume inode, otherwise the permission
> + * checking above is useless because we may have
> + * permission on a lower diretory but not the subvol
> + * itself.
> + */
> + ret = -EINVAL;
> } else {
> ret = btrfs_mksnapshot(&file->f_path, idmap,
> name, namelen,
> --
> 2.43.0
>
>
Yes, please!
Reviewed-by: Neal Gompa <neal@xxxxxxxxx>
--
真実はいつも一つ！/ Always, there's only one truth!
