Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4dc2b8c authored by Li Zefan's avatar Li Zefan Committed by Chris Mason
Browse files

Btrfs: Fix BTRFS_IOC_SUBVOL_SETFLAGS ioctl 



- Check user-specified flags correctly
- Check the inode owership
- Search root item in root tree but not fs tree

Reported-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent c87f08ca

fs/btrfs/ioctl.c

+5 −2
Original line number Diff line number Diff line
@@ -1071,12 +1071,15 @@ static noinline int btrfs_ioctl_subvol_setflags(struct file *file, 
	if (copy_from_user(&flags, arg, sizeof(flags)))

		return -EFAULT;



	if (flags & ~BTRFS_SUBVOL_CREATE_ASYNC)

	if (flags & BTRFS_SUBVOL_CREATE_ASYNC)

		return -EINVAL;



	if (flags & ~BTRFS_SUBVOL_RDONLY)

		return -EOPNOTSUPP;



	if (!is_owner_or_cap(inode))

		return -EACCES;



	down_write(&root->fs_info->subvol_sem);



	/* nothing to do */
@@ -1097,7 +1100,7 @@ static noinline int btrfs_ioctl_subvol_setflags(struct file *file, 
		goto out_reset;

	}



	ret = btrfs_update_root(trans, root,

	ret = btrfs_update_root(trans, root->fs_info->tree_root,

				&root->root_key, &root->root_item);



	btrfs_commit_transaction(trans, root);