From nobody Wed Jan 03 01:23:31 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4T4X6X05l6z56LB8; Wed, 3 Jan 2024 01:23:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4T4X6W6Vx9z4FDp; Wed, 3 Jan 2024 01:23:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704245011; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DcPANmVHmuVKBDYPOAJvbqybnepAliPz5bFzNP6szcs=; b=ooUE3EdhMLJHLHEpz3VaalatyyGS9MIzq3Pm1c9zAXJ25HfVP2VSOExeKOCXO9OUUKEZjF 94ltlX7Yt/FGT9f6bNukp9sccneLw7t9j4q2BeiEJxMr+Is6X1oOufJPlIgN9d8welIOBO 62kyaNtIBQBYuT/lTPAVsFofE9UAORKBIhEBC6HK+3G9hRI/LsdPG2I1HFdh2WiyfybmKV c3BgWG98OkLxnXSFc/LYVTbnHX7NdvquOOypcDjLi8QgI7HwkHskTh7p7pj7HlS7Hxprup O10m2zAgj5Cme0LJLJjuSUwQDAo+dqzvOJehgOgrNW+0J3CKfGeyez3G9k6kEg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1704245011; a=rsa-sha256; cv=none; b=VmJC2AveUtBSuV3+WSB3SnpXn6kQm7Y3UiwPmpJvbg/PA31tFGTbnXpo1TqJTI/EZaD/Ak PyPsrBCDVcw2uVGOEE3DVb+MYJ8euO/lX4d7llSgPnvk5R9aNCzAMnIY+32l0xAQQqy68I Y0tQkScQsDj2ph5duuPb8ovD9HzOe3hiOdKW9Q/9beb7+NX2l+s4ZNZZk2c24mroTZp3t/ ew6NxWOe3w9Kt1ENG34InRWAEBh6c+OE5xAKPYYDmEuBHkUZ/Ue6XnJSnSwJukMCqRL3NJ VuTk0+UC4vac/P4sQgYRgxywA+/v8ILC8GGyGSXcLpV3MopmcsZKPRFW/kCiZg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1704245011; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DcPANmVHmuVKBDYPOAJvbqybnepAliPz5bFzNP6szcs=; b=TKdXpHN5os9xnKtfamR4WuArjkDVXyJ0CbipIHX2PLtz5UARN25dvXf9JTjCW3/688c89m wmGUUAKgNz1wWqSbDBUCENxs8kEAJt0JyKKgqp552kw0xt1dgnwAQsrtSid8PSWYf9pCQV 1azLzr/zPuGMisVEXVTdGz7gNg7Dv7/Y9ptavYfRFJQbpSY2RGELLKoDVrQzXotWrQrapU cbkf780aKoOQNVhbgpopLyjdy6T2qgvhoQDgf6ahbOYaqxC4K+m5vMmI95+UAVX2B990rL Pnk+SaDuUFDLxT8iCegC/ai0bjUq6LUaMaM3dVQEdq00IDZJMc5792VDPjQaTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4T4X6W5XnHz1PBB; Wed, 3 Jan 2024 01:23:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 4031NV37090093; Wed, 3 Jan 2024 01:23:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 4031NVSu090090; Wed, 3 Jan 2024 01:23:31 GMT (envelope-from git) Date: Wed, 3 Jan 2024 01:23:31 GMT Message-Id: <202401030123.4031NVSu090090@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 2f3ff6fe1a69 - stable/14 - vfs_vnops.c: Fix vn_generic_copy_file_range() for truncation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 2f3ff6fe1a69ad5736e0d1d1575678c846e04402 Auto-Submitted: auto-generated The branch stable/14 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=2f3ff6fe1a69ad5736e0d1d1575678c846e04402 commit 2f3ff6fe1a69ad5736e0d1d1575678c846e04402 Author: Rick Macklem AuthorDate: 2023-12-31 23:55:24 +0000 Commit: Rick Macklem CommitDate: 2024-01-03 01:22:26 +0000 vfs_vnops.c: Fix vn_generic_copy_file_range() for truncation When copy_file_range(2) was first being developed, *inoffp + len had to be <= infile_size or an error was returned. This semantic (as defined by Linux) changed to allow *inoffp + len to be greater than infile_size and the copy would end at *inoffp + infile_size. Unfortunately, the code that decided if the outfd should be truncated in length did not get updated for this semantics change. As such, if a copy_file_range(2) is done, where infile_size - *inoffp is less that outfile_size but len is large, the outfd file is truncated when it should not be. (The semantics for this for Linux is to not truncate outfd in this case.) This patch fixes the problem. I believe the calculation is safe for all non-negative values of outsize, *outoffp, *inoffp and insize, which should be ok, since they are all guaranteed to be non-negative. Note that this bug is not observed over NFSv4.2, since it truncates len to infile_size - *inoffp. PR: 276045 (cherry picked from commit 2319ca6a01816f7fc85d623097c639f239e18c6a) --- sys/kern/vfs_vnops.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index e6a4b074b4e5..20632a3c4703 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -3363,8 +3363,7 @@ vn_generic_copy_file_range(struct vnode *invp, off_t *inoffp, goto out; if (VOP_PATHCONF(invp, _PC_MIN_HOLE_SIZE, &holein) != 0) holein = 0; - if (holein > 0) - error = vn_getsize_locked(invp, &insize, incred); + error = vn_getsize_locked(invp, &insize, incred); VOP_UNLOCK(invp); if (error != 0) goto out; @@ -3400,7 +3399,11 @@ vn_generic_copy_file_range(struct vnode *invp, off_t *inoffp, */ if (error == 0) error = vn_getsize_locked(outvp, &outsize, outcred); - if (error == 0 && outsize > *outoffp && outsize <= *outoffp + len) { + if (error == 0 && outsize > *outoffp && + *outoffp <= OFF_MAX - len && outsize <= *outoffp + len && + *inoffp < insize && + *outoffp <= OFF_MAX - (insize - *inoffp) && + outsize <= *outoffp + (insize - *inoffp)) { #ifdef MAC error = mac_vnode_check_write(curthread->td_ucred, outcred, outvp);