Btrfs: prevent loops in the directory tree when creating snapshots

For a directory tree:

/mnt/subvolA/subvolB

btrfsctl -s /mnt/subvolA/subvolB /mnt

Will create a directory loop with subvolA under subvolB.  This
commit uses the forward refs for each subvol and snapshot to error out
before creating the loop.

Signed-off-by: Chris Mason <chris.mason@oracle.com>

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index ad2cbe6..70b3dbb 100644 (file)
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1801,6 +1801,9 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                        struct extent_buffer *node,
                        struct extent_buffer *parent);
 /* root-item.c */
+int btrfs_find_root_ref(struct btrfs_root *tree_root,
+                  struct btrfs_path *path,
+                  u64 root_id, u64 ref_id);
 int btrfs_add_root_ref(struct btrfs_trans_handle *trans,
                       struct btrfs_root *tree_root,
                       u64 root_id, u8 type, u64 ref_id,

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8d7866b..e18250a 100644 (file)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1129,7 +1129,7 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_fs_info *fs_info,
                kfree(root);
                return ERR_PTR(ret);
        }
-
+#if 0
        ret = btrfs_sysfs_add_root(root);
        if (ret) {
                free_extent_buffer(root->node);
@@ -1137,6 +1137,7 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_fs_info *fs_info,
                kfree(root);
                return ERR_PTR(ret);
        }
+#endif
        root->in_sysfs = 1;
        return root;
 }
@@ -1963,8 +1964,10 @@ int btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root)
                down_write(&root->anon_super.s_umount);
                kill_anon_super(&root->anon_super);
        }
+#if 0
        if (root->in_sysfs)
                btrfs_sysfs_del_root(root);
+#endif
        if (root->node)
                free_extent_buffer(root->node);
        if (root->commit_root)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 536ae88..8828109 100644 (file)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -284,6 +284,56 @@ static noinline int btrfs_mksubvol(struct path *parent, char *name,
         * subvolume with specific mode bits.
         */
        if (snap_src) {
+               struct dentry *dir = dentry->d_parent;
+               struct dentry *test = dir->d_parent;
+               struct btrfs_path *path = btrfs_alloc_path();
+               int ret;
+               u64 test_oid;
+               u64 parent_oid = BTRFS_I(dir->d_inode)->root->root_key.objectid;
+
+               test_oid = snap_src->root_key.objectid;
+
+               ret = btrfs_find_root_ref(snap_src->fs_info->tree_root,
+                                         path, parent_oid, test_oid);
+               if (ret == 0)
+                       goto create;
+               btrfs_release_path(snap_src->fs_info->tree_root, path);
+
+               /* we need to make sure we aren't creating a directory loop
+                * by taking a snapshot of something that has our current
+                * subvol in its directory tree.  So, this loops through
+                * the dentries and checks the forward refs for each subvolume
+                * to see if is references the subvolume where we are
+                * placing this new snapshot.
+                */
+               while(1) {
+                       if (!test ||
+                           dir == snap_src->fs_info->sb->s_root ||
+                           test == snap_src->fs_info->sb->s_root ||
+                           test->d_inode->i_sb != snap_src->fs_info->sb) {
+                               break;
+                       }
+                       if (S_ISLNK(test->d_inode->i_mode)) {
+                               printk("Symlink in snapshot path, failed\n");
+                               error = -EMLINK;
+                               btrfs_free_path(path);
+                               goto out_drop_write;
+                       }
+                       test_oid =
+                               BTRFS_I(test->d_inode)->root->root_key.objectid;
+                       ret = btrfs_find_root_ref(snap_src->fs_info->tree_root,
+                                 path, test_oid, parent_oid);
+                       if (ret == 0) {
+                               printk("Snapshot creation failed, looping\n");
+                               error = -EMLINK;
+                               btrfs_free_path(path);
+                               goto out_drop_write;
+                       }
+                       btrfs_release_path(snap_src->fs_info->tree_root, path);
+                       test = test->d_parent;
+               }
+create:
+               btrfs_free_path(path);
                error = create_snapshot(snap_src, dentry, name, namelen);
        } else {
                error = create_subvol(BTRFS_I(parent->dentry->d_inode)->root,

diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index e9be3ab..dbe20d4 100644 (file)
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -300,6 +300,22 @@ int btrfs_del_root_ref(struct btrfs_trans_handle *trans,
        return ret;
 }
 
+int btrfs_find_root_ref(struct btrfs_root *tree_root,
+                  struct btrfs_path *path,
+                  u64 root_id, u64 ref_id)
+{
+       struct btrfs_key key;
+       int ret;
+
+       key.objectid = root_id;
+       key.type = BTRFS_ROOT_REF_KEY;
+       key.offset = ref_id;
+
+       ret = btrfs_search_slot(NULL, tree_root, &key, path, 0, 0);
+       return ret;
+}
+
+
 /*
  * add a btrfs_root_ref item.  type is either BTRFS_ROOT_REF_KEY
  * or BTRFS_ROOT_BACKREF_KEY.