upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 00:32:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

vfs_syscalls.c: Fix handling of offset args for copy_file_range

Browse source 
Commit 197997a broke handling of the offset
arguments to copy_file_range() when specified non-NULL.
The code fails to update the offsets and, as such, a loop like:

do {

   len = copy_file_range(infd, &inpos, outfd, &outpos,
      SSIZE_MAX, 0);
} while (len > 0);

becomes an infinite loop, just doing the same copy over and
over again.

This patch fixes it.

The clause "(foffsets_locked || foffsets_set)" in the if is not
actually needed for correctness, but I thought it made the code
a little more readable and might avoid some static
analyzer from throwing a "used before being set" for
the savinoff and savoutoff variables.

Approved by:	so
Security:	FreeBSD-EN-25:16.vfs

(cherry picked from commit 4046ad6bb0)
(cherry picked from commit 2fd0083fcc23f4c25860b8890292448720a5961c)
This commit is contained in:
Rick Macklem 2025-08-09 14:15:07 -07:00 committed by Franco Fichtner
parent 6d35ce377f
commit 74bbb9e8b9
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
sys/kern/vfs_syscalls.c
View file

@ -4908,11 +4908,12 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
size_t retlen;
void *rl_rcookie, *rl_wcookie;
off_t inoff, outoff, savinoff, savoutoff;
bool foffsets_locked;
bool foffsets_locked, foffsets_set;
infp = outfp = NULL;
rl_rcookie = rl_wcookie = NULL;
foffsets_locked = false;
foffsets_set = false;
error = 0;
retlen = 0;
@ -4980,6 +4981,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
}
foffset_lock_pair(infp1, &inoff, outfp1, &outoff, 0);
foffsets_locked = true;
} else {
foffsets_set = true;
}
savinoff = inoff;
savoutoff = outoff;
@ -5035,11 +5038,12 @@ out:
vn_rangelock_unlock(invp, rl_rcookie);
if (rl_wcookie != NULL)
vn_rangelock_unlock(outvp, rl_wcookie);
if ((foffsets_locked || foffsets_set) &&
(error == EINTR || error == ERESTART)) {
inoff = savinoff;
outoff = savoutoff;
}
if (foffsets_locked) {
if (error == EINTR || error == ERESTART) {
inoff = savinoff;
outoff = savoutoff;
}
if (inoffp == NULL)
foffset_unlock(infp, inoff, 0);
else
@ -5048,6 +5052,9 @@ out:
foffset_unlock(outfp, outoff, 0);
else
*outoffp = outoff;
} else if (foffsets_set) {
*inoffp = inoff;
*outoffp = outoff;
}
if (outfp != NULL)
fdrop(outfp, td);