git: d1e981cbf3bd - releng/14.3 - vfs_syscalls.c: Fix handling of offset args for copy_file_range

The branch releng/14.3 has been updated by gordon:

URL: https://cgit.FreeBSD.org/src/commit/?id=d1e981cbf3bdfff5a3fb7a2d21d80c0ed747524d

commit d1e981cbf3bdfff5a3fb7a2d21d80c0ed747524d
Author:     Rick Macklem <rmacklem@FreeBSD.org>
AuthorDate: 2025-08-09 21:15:07 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2025-09-14 00:23:36 +0000

    vfs_syscalls.c: Fix handling of offset args for copy_file_range
    
    Commit 197997a broke handling of the offset
    arguments to copy_file_range() when specified non-NULL.
    The code fails to update the offsets and, as such, a loop like:
    
    do {
    
       len = copy_file_range(infd, &inpos, outfd, &outpos,
          SSIZE_MAX, 0);
    } while (len > 0);
    
    becomes an infinite loop, just doing the same copy over and
    over again.
    
    This patch fixes it.
    
    The clause "(foffsets_locked || foffsets_set)" in the if is not
    actually needed for correctness, but I thought it made the code
    a little more readable and might avoid some static
    analyzer from throwing a "used before being set" for
    the savinoff and savoutoff variables.
    
    Approved by:    so
    Security:       FreeBSD-EN-25:16.vfs
    
    (cherry picked from commit 4046ad6bb0ee542a42d89a48a7d6a56564ed7f33)
    (cherry picked from commit 2fd0083fcc23f4c25860b8890292448720a5961c)
---
 sys/kern/vfs_syscalls.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 02908f76ef85..6756925416a3 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -4908,11 +4908,12 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
 	size_t retlen;
 	void *rl_rcookie, *rl_wcookie;
 	off_t inoff, outoff, savinoff, savoutoff;
-	bool foffsets_locked;
+	bool foffsets_locked, foffsets_set;
 
 	infp = outfp = NULL;
 	rl_rcookie = rl_wcookie = NULL;
 	foffsets_locked = false;
+	foffsets_set = false;
 	error = 0;
 	retlen = 0;
 
@@ -4980,6 +4981,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd,
 		}
 		foffset_lock_pair(infp1, &inoff, outfp1, &outoff, 0);
 		foffsets_locked = true;
+	} else {
+		foffsets_set = true;
 	}
 	savinoff = inoff;
 	savoutoff = outoff;
@@ -5035,11 +5038,12 @@ out:
 		vn_rangelock_unlock(invp, rl_rcookie);
 	if (rl_wcookie != NULL)
 		vn_rangelock_unlock(outvp, rl_wcookie);
+	if ((foffsets_locked || foffsets_set) &&
+	    (error == EINTR || error == ERESTART)) {
+		inoff = savinoff;
+		outoff = savoutoff;
+	}
 	if (foffsets_locked) {
-		if (error == EINTR || error == ERESTART) {
-			inoff = savinoff;
-			outoff = savoutoff;
-		}
 		if (inoffp == NULL)
 			foffset_unlock(infp, inoff, 0);
 		else
@@ -5048,6 +5052,9 @@ out:
 			foffset_unlock(outfp, outoff, 0);
 		else
 			*outoffp = outoff;
+	} else if (foffsets_set) {
+		*inoffp = inoff;
+		*outoffp = outoff;
 	}
 	if (outfp != NULL)
 		fdrop(outfp, td);