Date: Sat, 23 Aug 2025 21:25:20 GMT From: Rick Macklem <rmacklem@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 2fd0083fcc23 - stable/14 - vfs_syscalls.c: Fix handling of offset args for copy_file_range Message-ID: <202508232125.57NLPK5i098586@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=2fd0083fcc23f4c25860b8890292448720a5961c commit 2fd0083fcc23f4c25860b8890292448720a5961c Author: Rick Macklem <rmacklem@FreeBSD.org> AuthorDate: 2025-08-09 21:15:07 +0000 Commit: Rick Macklem <rmacklem@FreeBSD.org> CommitDate: 2025-08-23 21:22:14 +0000 vfs_syscalls.c: Fix handling of offset args for copy_file_range Commit 197997a broke handling of the offset arguments to copy_file_range() when specified non-NULL. The code fails to update the offsets and, as such, a loop like: do { len = copy_file_range(infd, &inpos, outfd, &outpos, SSIZE_MAX, 0); } while (len > 0); becomes an infinite loop, just doing the same copy over and over again. This patch fixes it. The clause "(foffsets_locked || foffsets_set)" in the if is not actually needed for correctness, but I thought it made the code a little more readable and might avoid some static analyzer from throwing a "used before being set" for the savinoff and savoutoff variables. (cherry picked from commit 4046ad6bb0ee542a42d89a48a7d6a56564ed7f33) --- sys/kern/vfs_syscalls.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 37dc48c6a297..ded3a87e7f8b 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -4918,11 +4918,12 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd, size_t retlen; void *rl_rcookie, *rl_wcookie; off_t inoff, outoff, savinoff, savoutoff; - bool foffsets_locked; + bool foffsets_locked, foffsets_set; infp = outfp = NULL; rl_rcookie = rl_wcookie = NULL; foffsets_locked = false; + foffsets_set = false; error = 0; retlen = 0; @@ -4990,6 +4991,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd, } foffset_lock_pair(infp1, &inoff, outfp1, &outoff, 0); foffsets_locked = true; + } else { + foffsets_set = true; } savinoff = inoff; savoutoff = outoff; @@ -5045,11 +5048,12 @@ out: vn_rangelock_unlock(invp, rl_rcookie); if (rl_wcookie != NULL) vn_rangelock_unlock(outvp, rl_wcookie); + if ((foffsets_locked || foffsets_set) && + (error == EINTR || error == ERESTART)) { + inoff = savinoff; + outoff = savoutoff; + } if (foffsets_locked) { - if (error == EINTR || error == ERESTART) { - inoff = savinoff; - outoff = savoutoff; - } if (inoffp == NULL) foffset_unlock(infp, inoff, 0); else @@ -5058,6 +5062,9 @@ out: foffset_unlock(outfp, outoff, 0); else *outoffp = outoff; + } else if (foffsets_set) { + *inoffp = inoff; + *outoffp = outoff; } if (outfp != NULL) fdrop(outfp, td);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202508232125.57NLPK5i098586>