git: 89188bd6ba8d - main - vn_copy_file_range(): use local variables for invp/outvp vnodes v_mounts

From: Konstantin Belousov <kib_at_FreeBSD.org>
Date: Mon, 13 Nov 2023 22:28:01 UTC
The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=89188bd6ba8d8332c65498f2b71c90e5ed4b9dae

commit 89188bd6ba8d8332c65498f2b71c90e5ed4b9dae
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2023-11-12 18:29:14 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2023-11-13 22:26:28 +0000

    vn_copy_file_range(): use local variables for invp/outvp vnodes v_mounts
    
    This avoids possible NULL dereference when checking mnt_vfc names.
    
    Reviewed by:    jah, rmacklem, Olivier Certner <olce.freebsd@certner.fr>
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D42554
---
 sys/kern/vfs_vnops.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index 4e4161ef1a7f..e2227537dde1 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -3046,6 +3046,7 @@ vn_copy_file_range(struct vnode *invp, off_t *inoffp, struct vnode *outvp,
     off_t *outoffp, size_t *lenp, unsigned int flags, struct ucred *incred,
     struct ucred *outcred, struct thread *fsize_td)
 {
+	struct mount *inmp, *outmp;
 	int error;
 	size_t len;
 	uint64_t uval;
@@ -3075,15 +3076,17 @@ vn_copy_file_range(struct vnode *invp, off_t *inoffp, struct vnode *outvp,
 	if (len == 0)
 		goto out;
 
+	inmp = invp->v_mount;
+	outmp = outvp->v_mount;
+
 	/*
 	 * If the two vnodes are for the same file system type, call
 	 * VOP_COPY_FILE_RANGE(), otherwise call vn_generic_copy_file_range()
 	 * which can handle copies across multiple file system types.
 	 */
 	*lenp = len;
-	if (invp->v_mount == outvp->v_mount ||
-	    strcmp(invp->v_mount->mnt_vfc->vfc_name,
-	    outvp->v_mount->mnt_vfc->vfc_name) == 0)
+	if (inmp == outmp || strcmp(inmp->mnt_vfc->vfc_name,
+	    outmp->mnt_vfc->vfc_name) == 0)
 		error = VOP_COPY_FILE_RANGE(invp, inoffp, outvp, outoffp,
 		    lenp, flags, incred, outcred, fsize_td);
 	else