Commit d6d09a69 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-5.14-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 

Pull btrfs fix from David Sterba:
 "One more fix for cross-rename, adding a missing check for directory
  and subvolume, this could lead to a crash"

* tag 'for-5.14-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
parents 01f15f37 3f79f6f6

fs/btrfs/inode.c

+8 −2
Original line number Diff line number Diff line
@@ -9226,8 +9226,14 @@ static int btrfs_rename_exchange(struct inode *old_dir, 
	bool dest_log_pinned = false;

	bool need_abort = false;



	/* we only allow rename subvolume link between subvolumes */

	if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest)

	/*

	 * For non-subvolumes allow exchange only within one subvolume, in the

	 * same inode namespace. Two subvolumes (represented as directory) can

	 * be exchanged as they're a logical link and have a fixed inode number.

	 */

	if (root != dest &&

	    (old_ino != BTRFS_FIRST_FREE_OBJECTID ||

	     new_ino != BTRFS_FIRST_FREE_OBJECTID))

		return -EXDEV;



	/* close the race window with snapshot create/destroy ioctl */