btrfs: protect snapshots from deleting during send

The patch "Btrfs: fix protection between send and root deletion"
(18f687d538449373c37c) does not actually prevent to delete the snapshot
and just takes care during background cleaning, but this seems rather
user unfriendly, this patch implements the idea presented in

http://www.spinics.net/lists/linux-btrfs/msg30813.html

- add an internal root_item flag to denote a dead root
- check if the send_in_progress is set and refuse to delete, otherwise
  set the flag and proceed
- check the flag in send similar to the btrfs_root_readonly checks, for
  all involved roots

The root lookup in send via btrfs_read_fs_root_no_name will check if the
root is really dead or not. If it is, ENOENT, aborted send. If it's
alive, it's protected by send_in_progress, send can continue.

CC: Miao Xie <miaox@cn.fujitsu.com>
CC: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>

1 files changed, 30 insertions, 0 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 2db12fc3f748..2db3fe12f50d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2219,6 +2219,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         struct btrfs_ioctl_vol_args *vol_args;
         struct btrfs_trans_handle *trans;
         struct btrfs_block_rsv block_rsv;
+        u64 root_flags;
         u64 qgroup_reserved;
         int namelen;
         int ret;
@@ -2240,6 +2241,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         if (err)
                 goto out;
 
+
         err = mutex_lock_killable_nested(&dir->i_mutex, I_MUTEX_PARENT);
         if (err == -EINTR)
                 goto out_drop_write;
@@ -2301,6 +2303,27 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         }
 
         mutex_lock(&inode->i_mutex);
+
+        /*
+         * Don't allow to delete a subvolume with send in progress. This is
+         * inside the i_mutex so the error handling that has to drop the bit
+         * again is not run concurrently.
+         */
+        spin_lock(&dest->root_item_lock);
+        root_flags = btrfs_root_flags(&root->root_item);
+        if (root->send_in_progress == 0) {
+                btrfs_set_root_flags(&root->root_item,
+                                root_flags | BTRFS_ROOT_SUBVOL_DEAD);
+                spin_unlock(&dest->root_item_lock);
+        } else {
+                spin_unlock(&dest->root_item_lock);
+                btrfs_warn(root->fs_info,
+                        "Attempt to delete subvolume %llu during send",
+                        root->root_key.objectid);
+                err = -EPERM;
+                goto out_dput;
+        }
+
         err = d_invalidate(dentry);
         if (err)
                 goto out_unlock;
@@ -2389,6 +2412,13 @@ out_release:
 out_up_write:
         up_write(&root->fs_info->subvol_sem);
 out_unlock:
+        if (err) {
+                spin_lock(&dest->root_item_lock);
+                root_flags = btrfs_root_flags(&root->root_item);
+                btrfs_set_root_flags(&root->root_item,
+                                root_flags & ~BTRFS_ROOT_SUBVOL_DEAD);
+                spin_unlock(&dest->root_item_lock);
+        }
         mutex_unlock(&inode->i_mutex);
         if (!err) {
                 shrink_dcache_sb(root->fs_info->sb);