Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4dc2b8c authored by Li Zefan's avatar Li Zefan Committed by Chris Mason
Browse files

Btrfs: Fix BTRFS_IOC_SUBVOL_SETFLAGS ioctl



- Check user-specified flags correctly
- Check the inode owership
- Search root item in root tree but not fs tree

Reported-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent c87f08ca
Loading
Loading
Loading
Loading
+5 −2
Original line number Diff line number Diff line
@@ -1071,12 +1071,15 @@ static noinline int btrfs_ioctl_subvol_setflags(struct file *file,
	if (copy_from_user(&flags, arg, sizeof(flags)))
		return -EFAULT;

	if (flags & ~BTRFS_SUBVOL_CREATE_ASYNC)
	if (flags & BTRFS_SUBVOL_CREATE_ASYNC)
		return -EINVAL;

	if (flags & ~BTRFS_SUBVOL_RDONLY)
		return -EOPNOTSUPP;

	if (!is_owner_or_cap(inode))
		return -EACCES;

	down_write(&root->fs_info->subvol_sem);

	/* nothing to do */
@@ -1097,7 +1100,7 @@ static noinline int btrfs_ioctl_subvol_setflags(struct file *file,
		goto out_reset;
	}

	ret = btrfs_update_root(trans, root,
	ret = btrfs_update_root(trans, root->fs_info->tree_root,
				&root->root_key, &root->root_item);

	btrfs_commit_transaction(trans, root);