Re: git: 89188bd6ba8d - main - vn_copy_file_range(): use local variables for invp/outvp vnodes v_mounts

On 11/13/23, Konstantin Belousov <kib@freebsd.org> wrote:
> The branch main has been updated by kib:
>
> URL:
> https://cgit.FreeBSD.org/src/commit/?id=89188bd6ba8d8332c65498f2b71c90e5ed4b9dae
>
> commit 89188bd6ba8d8332c65498f2b71c90e5ed4b9dae
> Author:     Konstantin Belousov <kib@FreeBSD.org>
> AuthorDate: 2023-11-12 18:29:14 +0000
> Commit:     Konstantin Belousov <kib@FreeBSD.org>
> CommitDate: 2023-11-13 22:26:28 +0000
>
>     vn_copy_file_range(): use local variables for invp/outvp vnodes
> v_mounts
>
>     This avoids possible NULL dereference when checking mnt_vfc names.
>
>     Reviewed by:    jah, rmacklem, Olivier Certner
> <olce.freebsd@certner.fr>
>     Tested by:      pho
>     Sponsored by:   The FreeBSD Foundation
>     MFC after:      1 week
>     Differential revision:  https://reviews.freebsd.org/D42554
> ---
>  sys/kern/vfs_vnops.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
> index 4e4161ef1a7f..e2227537dde1 100644
> --- a/sys/kern/vfs_vnops.c
> +++ b/sys/kern/vfs_vnops.c
> @@ -3046,6 +3046,7 @@ vn_copy_file_range(struct vnode *invp, off_t *inoffp,
> struct vnode *outvp,
>      off_t *outoffp, size_t *lenp, unsigned int flags, struct ucred
> *incred,
>      struct ucred *outcred, struct thread *fsize_td)
>  {
> +	struct mount *inmp, *outmp;
>  	int error;
>  	size_t len;
>  	uint64_t uval;
> @@ -3075,15 +3076,17 @@ vn_copy_file_range(struct vnode *invp, off_t
> *inoffp, struct vnode *outvp,
>  	if (len == 0)
>  		goto out;
>
> +	inmp = invp->v_mount;
> +	outmp = outvp->v_mount;
> +
>  	/*
>  	 * If the two vnodes are for the same file system type, call
>  	 * VOP_COPY_FILE_RANGE(), otherwise call vn_generic_copy_file_range()
>  	 * which can handle copies across multiple file system types.
>  	 */
>  	*lenp = len;
> -	if (invp->v_mount == outvp->v_mount ||
> -	    strcmp(invp->v_mount->mnt_vfc->vfc_name,
> -	    outvp->v_mount->mnt_vfc->vfc_name) == 0)
> +	if (inmp == outmp || strcmp(inmp->mnt_vfc->vfc_name,
> +	    outmp->mnt_vfc->vfc_name) == 0)
>  		error = VOP_COPY_FILE_RANGE(invp, inoffp, outvp, outoffp,
>  		    lenp, flags, incred, outcred, fsize_td);
>  	else
>
>

->mnt_vfc is global per filesystem code, so this strcmp does not make
any sense. mere comparison to mnt_vfc will do it.

-- 
Mateusz Guzik <mjguzik gmail.com>