Btrfs: prevent loops in the directory tree when creating snapshots

For a directory tree:

/mnt/subvolA/subvolB

btrfsctl -s /mnt/subvolA/subvolB /mnt

Will create a directory loop with subvolA under subvolB.  This
commit uses the forward refs for each subvol and snapshot to error out
before creating the loop.

Signed-off-by: Chris Mason <chris.mason@oracle.com>

4 files changed, 73 insertions, 1 deletions

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index ad2cbe63503c..70b3dbb4de12 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1801,6 +1801,9 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                         struct extent_buffer *node,
                         struct extent_buffer *parent);
 /* root-item.c */
+int btrfs_find_root_ref(struct btrfs_root *tree_root,
+                   struct btrfs_path *path,
+                   u64 root_id, u64 ref_id);
 int btrfs_add_root_ref(struct btrfs_trans_handle *trans,
                        struct btrfs_root *tree_root,
                        u64 root_id, u8 type, u64 ref_id,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8d7866b733d6..e18250a6fd2d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1129,7 +1129,7 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_fs_info *fs_info,
                 kfree(root);
                 return ERR_PTR(ret);
         }
-
+#if 0
         ret = btrfs_sysfs_add_root(root);
         if (ret) {
                 free_extent_buffer(root->node);
@@ -1137,6 +1137,7 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_fs_info *fs_info,
                 kfree(root);
                 return ERR_PTR(ret);
         }
+#endif
         root->in_sysfs = 1;
         return root;
 }
@@ -1963,8 +1964,10 @@ int btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root)
                 down_write(&root->anon_super.s_umount);
                 kill_anon_super(&root->anon_super);
         }
+#if 0
         if (root->in_sysfs)
                 btrfs_sysfs_del_root(root);
+#endif
         if (root->node)
                 free_extent_buffer(root->node);
         if (root->commit_root)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 536ae8837801..8828109fa58e 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -284,6 +284,56 @@ static noinline int btrfs_mksubvol(struct path *parent, char *name,
          * subvolume with specific mode bits.
          */
         if (snap_src) {
+                struct dentry *dir = dentry->d_parent;
+                struct dentry *test = dir->d_parent;
+                struct btrfs_path *path = btrfs_alloc_path();
+                int ret;
+                u64 test_oid;
+                u64 parent_oid = BTRFS_I(dir->d_inode)->root->root_key.objectid;
+
+                test_oid = snap_src->root_key.objectid;
+
+                ret = btrfs_find_root_ref(snap_src->fs_info->tree_root,
+                                          path, parent_oid, test_oid);
+                if (ret == 0)
+                        goto create;
+                btrfs_release_path(snap_src->fs_info->tree_root, path);
+
+                /* we need to make sure we aren't creating a directory loop
+                 * by taking a snapshot of something that has our current
+                 * subvol in its directory tree.  So, this loops through
+                 * the dentries and checks the forward refs for each subvolume
+                 * to see if is references the subvolume where we are
+                 * placing this new snapshot.
+                 */
+                while(1) {
+                        if (!test ||
+                            dir == snap_src->fs_info->sb->s_root ||
+                            test == snap_src->fs_info->sb->s_root ||
+                            test->d_inode->i_sb != snap_src->fs_info->sb) {
+                                break;
+                        }
+                        if (S_ISLNK(test->d_inode->i_mode)) {
+                                printk("Symlink in snapshot path, failed\n");
+                                error = -EMLINK;
+                                btrfs_free_path(path);
+                                goto out_drop_write;
+                        }
+                        test_oid =
+                                BTRFS_I(test->d_inode)->root->root_key.objectid;
+                        ret = btrfs_find_root_ref(snap_src->fs_info->tree_root,
+                                  path, test_oid, parent_oid);
+                        if (ret == 0) {
+                                printk("Snapshot creation failed, looping\n");
+                                error = -EMLINK;
+                                btrfs_free_path(path);
+                                goto out_drop_write;
+                        }
+                        btrfs_release_path(snap_src->fs_info->tree_root, path);
+                        test = test->d_parent;
+                }
+create:
+                btrfs_free_path(path);
                 error = create_snapshot(snap_src, dentry, name, namelen);
         } else {
                 error = create_subvol(BTRFS_I(parent->dentry->d_inode)->root,
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index e9be3abcb368..dbe20d4c6ea4 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -300,6 +300,22 @@ int btrfs_del_root_ref(struct btrfs_trans_handle *trans,
         return ret;
 }
 
+int btrfs_find_root_ref(struct btrfs_root *tree_root,
+                   struct btrfs_path *path,
+                   u64 root_id, u64 ref_id)
+{
+        struct btrfs_key key;
+        int ret;
+
+        key.objectid = root_id;
+        key.type = BTRFS_ROOT_REF_KEY;
+        key.offset = ref_id;
+
+        ret = btrfs_search_slot(NULL, tree_root, &key, path, 0, 0);
+        return ret;
+}
+
+
 /*
  * add a btrfs_root_ref item.  type is either BTRFS_ROOT_REF_KEY
  * or BTRFS_ROOT_BACKREF_KEY.