[PATCH] deny sys_{rename,link} across subvolumes of same disk

[Christian Parpart <trapni@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 357 bytes --]

This patch denies renames and linking of inodes across subvolumes, as it 
causes disk format corruption.

I guess a long-term goal *might* be to just handle these special cases with 
care, to allow them by properly handling this case in the implementation, 
however, I wasn't unable to do that with my limited knowledge.

Best regards,
Christian Parpart.



[-- Attachment #2: cross-subvol-change-fix.diff --]
[-- Type: text/x-patch, Size: 842 bytes --]

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ff0c359..20a3772 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2748,6 +2748,10 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
 	if (inode->i_nlink == 0)
 		return -ENOENT;
 
+	/* do not allow sys_link's with other subvols of the same device */
+	if (root->objectid != BTRFS_I(inode)->root->objectid)
+		return -EPERM;
+
 	btrfs_inc_nlink(inode);
 	err = btrfs_check_free_space(root, 1, 0);
 	if (err)
@@ -3577,6 +3581,10 @@ static int btrfs_rename(struct inode * old_dir, struct dentry *old_dentry,
 		return -ENOTEMPTY;
 	}
 
+	/* do not allow sys_rename's with other subvols of the same device */
+	if (root->objectid != BTRFS_I(new_dir)->root->objectid)
+		return -EPERM;
+
 	ret = btrfs_check_free_space(root, 1, 0);
 	if (ret)
 		goto out_unlock;