[PATCH v3] btrfs: allow idmapped DEFRAG ioctls

[PATCH v3] btrfs: allow idmapped DEFRAG ioctls

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

btrfs_ioctl_defrag() checks MAY_WRITE against nop_mnt_idmap, so on an
idmapped mount the owner comparison uses the caller's fsuid against the
raw on-disk uid and the ioctl fails with -EPERM even for the file's
owner.  Pass the mount idmap down so defrag works on idmapped mounts.

The check, added in 616d374efa23 ("btrfs: allow defrag on a file opened
read-only that has rw permissions"), is not a privilege gate.  It only
tests whether the file could have been opened for writing, and a user
who owns the file on the idmapped mount can already open it O_RDWR,
write() to it or fallocate() it.  Defragmenting a regular file only
rearranges the caller's own extents; there is nothing it can rewrite
that the caller could not rewrite anyway.  Whole-subvolume defrag on a
directory keeps its capable(CAP_SYS_ADMIN) requirement, and the
!capable() guard around this check is left as is.

FIDEDUPERANGE already works this way for unprivileged callers:
may_dedupe_file() in fs/remap_range.c compares the inode owner through
file_mnt_idmap(file) and falls back to inode_permission() with the same
idmap, and dedupe can rewrite one file's extents from another file's
contents, which is a stronger operation than defrag.

On regular mounts file_mnt_idmap() is nop_mnt_idmap and nothing
changes.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Seth Forshee <sforshee@kernel.org>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Changes in v3:
- Rebase onto linux-next (next-20261008); no functional changes.
- Collect tags from review.

Changes in v2:
- Rewrite the commit message to explain why defrag is safe for idmapped
  users (Seth Forshee); the code is unchanged.

Link: https://lore.kernel.org/r/20260815132259.3935817-1-cui.tao@linux.dev/ # v2
Link: https://lore.kernel.org/r/20260813034146.1207640-1-cui.tao@linux.dev/ # v1
---
 fs/btrfs/ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index f3e2afe221be..fe8c00eb38bc 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2473,7 +2473,7 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
 		 * running and allows defrag on files open in read-only mode.
 		 */
 		if (!capable(CAP_SYS_ADMIN) &&
-		    inode_permission(&nop_mnt_idmap, inode, MAY_WRITE)) {
+		    inode_permission(file_mnt_idmap(file), inode, MAY_WRITE)) {
 			ret = -EPERM;
 			goto out;
 		}
-- 
2.53.0