A UFS2 filesystem can hold up to FSMAXSNAP snapshots, recorded in fs_snapinum[]. A snapshot is an inode whose block pointers describe the state of the filesystem at the moment it was taken, using the reserved values BLK_NOCOPY and BLK_SNAP alongside ordinary block numbers. Keeping one valid requires copy on write: before a block that the snapshot references is overwritten or freed, its old contents have to be copied into the snapshot. Linux implements none of this. It does not read fs_snapinum[], does not know the SF_SNAPSHOT inode flag, and treats the reserved block pointer values 1 and 2 as ordinary fragment addresses. Mounting such a filesystem read-write and changing a single file is enough for every snapshot on it to stop describing the point in time it was taken at, and there is no way to notice afterwards. Refuse the read-write mount while any snapshot is recorded. Read-only access is unaffected. Signed-off-by: Ali Ahmet Memis --- fs/ufs/super.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ufs/super.c b/fs/ufs/super.c index df95502e039e..6132c28c4308 100644 --- a/fs/ufs/super.c +++ b/fs/ufs/super.c @@ -776,6 +776,7 @@ static bool ufs_features_allow_write(struct super_block *sb) { struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; struct ufs_super_block_third *usb3 = ubh_get_usb_third(uspi); + unsigned int i; u32 fsflags; if (uspi->fs_magic != UFS2_MAGIC) @@ -792,6 +793,12 @@ static bool ufs_features_allow_write(struct super_block *sb) __func__); return false; } + for (i = 0; i < UFS_FSMAXSNAP; i++) { + if (usb3->fs_un2.fs_44.fs_snapinum[i]) { + pr_err("%s(): fs has active snapshots\n", __func__); + return false; + } + } return true; } -- 2.55.0