Comment 11 for bug 1850867

Revision history for this message
Jann Horn (corp account) (jannh) wrote :

Re #10: I don't see how that's relevant here. shiftfs_btrfs_ioctl_fd_replace() does `src = fdget(oldfd)`, meaning that `src.file` contains some random file that may have no association whatsoever with shiftfs, or may be a special inode in a shiftfs. Then it calls shiftfs_real_fdget() on that file, which (with your patch) only checks the magic of the superblock. And the special inodes would still be on shiftfs' superblock, so that check would pass, right?