Merge branch 'linus' into locking/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

1 files changed, 12 insertions, 0 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index b2a2da5893af..7fd939bfbd99 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1634,6 +1634,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
         int namelen;
         int ret = 0;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         ret = mnt_want_write_file(file);
         if (ret)
                 goto out;
@@ -1691,6 +1694,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
         struct btrfs_ioctl_vol_args *vol_args;
         int ret;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);
@@ -1714,6 +1720,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
         bool readonly = false;
         struct btrfs_qgroup_inherit *inherit = NULL;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);
@@ -2357,6 +2366,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         int ret;
         int err = 0;
 
+        if (!S_ISDIR(dir->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);