git: a5f9fe2bab78 - main - copy_file_range(2): Fix for small values of input file offset and len

[Rick Macklem]

The branch main has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=a5f9fe2bab789f49e8b53da3a62dbd34725e23ea

commit a5f9fe2bab789f49e8b53da3a62dbd34725e23ea
Author:     Rick Macklem <rmacklem at FreeBSD.org>
AuthorDate: 2021-03-01 14:28:30 +0000
Commit:     Rick Macklem <rmacklem at FreeBSD.org>
CommitDate: 2021-03-01 14:31:10 +0000

    copy_file_range(2): Fix for small values of input file offset and len
    
    r366302 broke copy_file_range(2) for small values of
    input file offset and len.
    
    It was possible for rem to be greater than len and then
    "len - rem" was a large value, since both variables are
    unsigned.
    
    Reported by: koobs, Pablo <pablogsal gmail com> (Python)
    Reviewed by:    asomers, koobs
    MFC after:      3 days
    Differential Revision:  https://reviews.freebsd.org/D28981
---
 sys/kern/vfs_vnops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index 781968f2db53..7a0951fb07ca 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -3143,7 +3143,7 @@ vn_generic_copy_file_range(struct vnode *invp, off_t *inoffp,
 		rem = *inoffp % blksize;
 		if (rem > 0)
 			rem = blksize - rem;
-		if (len - rem > blksize)
+		if (len > rem && len - rem > blksize)
 			len = savlen = rounddown(len - rem, blksize) + rem;
 	}