git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
btrfs: ensure that file descriptor used with subvol ioctls is a dir
[pandora-kernel.git]
/
fs
/
btrfs
/
ioctl.c
diff --git
a/fs/btrfs/ioctl.c
b/fs/btrfs/ioctl.c
index
eb6a0e6
..
360072f
100644
(file)
--- a/
fs/btrfs/ioctl.c
+++ b/
fs/btrfs/ioctl.c
@@
-1302,6
+1302,9
@@
static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
int namelen;
int ret = 0;
int namelen;
int ret = 0;
+ if (!S_ISDIR(file->f_dentry->d_inode->i_mode))
+ return -ENOTDIR;
+
if (root->fs_info->sb->s_flags & MS_RDONLY)
return -EROFS;
if (root->fs_info->sb->s_flags & MS_RDONLY)
return -EROFS;
@@
-1350,6
+1353,9
@@
static noinline int btrfs_ioctl_snap_create(struct file *file,
struct btrfs_ioctl_vol_args *vol_args;
int ret;
struct btrfs_ioctl_vol_args *vol_args;
int ret;
+ if (!S_ISDIR(file->f_dentry->d_inode->i_mode))
+ return -ENOTDIR;
+
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);
@@
-1372,6
+1378,9
@@
static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
u64 *ptr = NULL;
bool readonly = false;
u64 *ptr = NULL;
bool readonly = false;
+ if (!S_ISDIR(file->f_dentry->d_inode->i_mode))
+ return -ENOTDIR;
+
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);
@@
-1848,6
+1857,9
@@
static noinline int btrfs_ioctl_snap_destroy(struct file *file,
int ret;
int err = 0;
int ret;
int err = 0;
+ if (!S_ISDIR(dir->i_mode))
+ return -ENOTDIR;
+
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args))
return PTR_ERR(vol_args);