git: 2d23f6c33431 - releng/13.2 - copy_file_range: require CAP_SEEK capability

The branch releng/13.2 has been updated by gordon:

URL: https://cgit.FreeBSD.org/src/commit/?id=2d23f6c33431b19d8f91ad4832db01aa25062d43

commit 2d23f6c33431b19d8f91ad4832db01aa25062d43
Author:     Mariusz Zaborski <oshogbo@FreeBSD.org>
AuthorDate: 2023-09-28 13:24:39 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2023-10-03 21:24:41 +0000

    copy_file_range: require CAP_SEEK capability
    
    When using copy_file_range(2) with an offset parameter,
    the CAP_SEEK capability should be required.
    This requirement is similar to the behavior observed with
    pread(2)/pwrite(2).
    
    Reported by:    theraven
    Reviewed by:    emaste, theraven, kib, markj
    Approved by:    so
    Security:       FreeBSD-SA-23:13.capsicum
    Security:       CVE-2023-5369
    Differential Revision:  https://reviews.freebsd.org/D41967
    
    (cherry picked from commit 15a51d3abaef27ddea66320cac7caa549738a1a6)
    (cherry picked from commit 3f0ce63828dc3d4030b32ad0effb4e588af49c03)
---
 sys/kern/vfs_syscalls.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 3b3947b2ccb7..449c5ace6094 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -4896,7 +4896,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
 		len = SSIZE_MAX;
 
 	/* Get the file structures for the file descriptors. */
-	error = fget_read(td, infd, &cap_read_rights, &infp);
+	error = fget_read(td, infd,
+	    inoffp != NULL ? &cap_pread_rights : &cap_read_rights, &infp);
 	if (error != 0)
 		goto out;
 	if (infp->f_ops == &badfileops) {
@@ -4907,7 +4908,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
 		error = EINVAL;
 		goto out;
 	}
-	error = fget_write(td, outfd, &cap_write_rights, &outfp);
+	error = fget_write(td, outfd,
+	    outoffp != NULL ? &cap_pwrite_rights : &cap_write_rights, &outfp);
 	if (error != 0)
 		goto out;
 	if (outfp->f_ops == &badfileops) {