The branch stable/14 has been updated by rmacklem:
URL:
https://cgit.FreeBSD.org/src/commit/?id=2fd0083fcc23f4c25860b8890292448720a5961c
commit 2fd0083fcc23f4c25860b8890292448720a5961c
Author: Rick Macklem <rmack...@freebsd.org>
AuthorDate: 2025-08-09 21:15:07 +0000
Commit: Rick Macklem <rmack...@freebsd.org>
CommitDate: 2025-08-23 21:22:14 +0000
vfs_syscalls.c: Fix handling of offset args for copy_file_range
Commit 197997a broke handling of the offset
arguments to copy_file_range() when specified non-NULL.
The code fails to update the offsets and, as such, a loop like:
do {
len = copy_file_range(infd, &inpos, outfd, &outpos,
SSIZE_MAX, 0);
} while (len > 0);
becomes an infinite loop, just doing the same copy over and
over again.
This patch fixes it.
The clause "(foffsets_locked || foffsets_set)" in the if is not
actually needed for correctness, but I thought it made the code
a little more readable and might avoid some static
analyzer from throwing a "used before being set" for
the savinoff and savoutoff variables.
(cherry picked from commit 4046ad6bb0ee542a42d89a48a7d6a56564ed7f33)
---
sys/kern/vfs_syscalls.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 37dc48c6a297..ded3a87e7f8b 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -4918,11 +4918,12 @@ kern_copy_file_range(struct thread *td, int infd, off_t
*inoffp, int outfd,
size_t retlen;
void *rl_rcookie, *rl_wcookie;
off_t inoff, outoff, savinoff, savoutoff;
- bool foffsets_locked;
+ bool foffsets_locked, foffsets_set;
infp = outfp = NULL;
rl_rcookie = rl_wcookie = NULL;
foffsets_locked = false;
+ foffsets_set = false;
error = 0;
retlen = 0;
@@ -4990,6 +4991,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t
*inoffp, int outfd,
}
foffset_lock_pair(infp1, &inoff, outfp1, &outoff, 0);
foffsets_locked = true;
+ } else {
+ foffsets_set = true;
}
savinoff = inoff;
savoutoff = outoff;
@@ -5045,11 +5048,12 @@ out:
vn_rangelock_unlock(invp, rl_rcookie);
if (rl_wcookie != NULL)
vn_rangelock_unlock(outvp, rl_wcookie);
+ if ((foffsets_locked || foffsets_set) &&
+ (error == EINTR || error == ERESTART)) {
+ inoff = savinoff;
+ outoff = savoutoff;
+ }
if (foffsets_locked) {
- if (error == EINTR || error == ERESTART) {
- inoff = savinoff;
- outoff = savoutoff;
- }
if (inoffp == NULL)
foffset_unlock(infp, inoff, 0);
else
@@ -5058,6 +5062,9 @@ out:
foffset_unlock(outfp, outoff, 0);
else
*outoffp = outoff;
+ } else if (foffsets_set) {
+ *inoffp = inoff;
+ *outoffp = outoff;
}
if (outfp != NULL)
fdrop(outfp, td);
