1 files changed, 8 insertions, 3 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 0e92e576300..7011871c45b 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2340,6 +2340,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 goto out_drop_write;
         }
 
+        ret = -EXDEV;
+        if (src_file->f_path.mnt != file->f_path.mnt)
+                goto out_fput;
+
         src = src_file->f_dentry->d_inode;
 
         ret = -EINVAL;
@@ -2360,7 +2364,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 goto out_fput;
 
         ret = -EXDEV;
-        if (src->i_sb != inode->i_sb || BTRFS_I(src)->root != root)
+        if (src->i_sb != inode->i_sb)
                 goto out_fput;
 
         ret = -ENOMEM;
@@ -2434,13 +2438,14 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                  * note the key will change type as we walk through the
                  * tree.
                  */
-                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+                ret = btrfs_search_slot(NULL, BTRFS_I(src)->root, &key, path,
+                                0, 0);
                 if (ret < 0)
                         goto out;
 
                 nritems = btrfs_header_nritems(path->nodes[0]);
                 if (path->slots[0] >= nritems) {
-                        ret = btrfs_next_leaf(root, path);
+                        ret = btrfs_next_leaf(BTRFS_I(src)->root, path);
                         if (ret < 0)
                                 goto out;
                         if (ret > 0)