diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2021-08-18 12:06:42 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2021-08-18 12:06:42 -0700 |
| commit | d6d09a6942050f21b065a134169002b4d6b701ef (patch) | |
| tree | d9485cbc7212e873476377d36c279a15e9fd0f07 | |
| parent | 01f15f3773bf3653a708e2c18c370beb16ca23c7 (diff) | |
| parent | 3f79f6f6247c83f448c8026c3ee16d4636ef8d4f (diff) | |
| download | linux-d6d09a6942050f21b065a134169002b4d6b701ef.tar.gz | |
Merge tag 'for-5.14-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fix from David Sterba:
"One more fix for cross-rename, adding a missing check for directory
and subvolume, this could lead to a crash"
* tag 'for-5.14-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
| -rw-r--r-- | fs/btrfs/inode.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 0117d867ecf876..06f9f167222b77 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -9226,8 +9226,14 @@ static int btrfs_rename_exchange(struct inode *old_dir, bool dest_log_pinned = false; bool need_abort = false; - /* we only allow rename subvolume link between subvolumes */ - if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest) + /* + * For non-subvolumes allow exchange only within one subvolume, in the + * same inode namespace. Two subvolumes (represented as directory) can + * be exchanged as they're a logical link and have a fixed inode number. + */ + if (root != dest && + (old_ino != BTRFS_FIRST_FREE_OBJECTID || + new_ino != BTRFS_FIRST_FREE_OBJECTID)) return -EXDEV; /* close the race window with snapshot create/destroy ioctl */ |