Attachment 247381 Details for Bug 276045 – Fix handling of truncation in vn_generic_copy_file_range()

[patch] Fix handling of truncation in vn_generic_copy_file_range()

copytrunc2.patch (text/plain), 1.00 KB, created by Rick Macklem on 2023-12-31 23:38:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rick Macklem

Created: 2023-12-31 23:38:12 UTC

Size: 1.00 KB

patch

obsolete

>--- sys/kern/vfs_vnops.c.copy	2023-12-30 15:27:34.014432000 -0800
>+++ sys/kern/vfs_vnops.c	2023-12-31 13:39:46.386543000 -0800
>@@ -3296,8 +3296,7 @@ vn_generic_copy_file_range(struct vnode *invp, off_t *
> 		goto out;
> 	if (VOP_PATHCONF(invp, _PC_MIN_HOLE_SIZE, &holein) != 0)
> 		holein = 0;
>-	if (holein > 0)
>-		error = vn_getsize_locked(invp, &insize, incred);
>+	error = vn_getsize_locked(invp, &insize, incred);
> 	VOP_UNLOCK(invp);
> 	if (error != 0)
> 		goto out;
>@@ -3333,7 +3332,11 @@ vn_generic_copy_file_range(struct vnode *invp, off_t *
> 		 */
> 		if (error == 0)
> 			error = vn_getsize_locked(outvp, &outsize, outcred);
>-		if (error == 0 && outsize > *outoffp && outsize <= *outoffp + len) {
>+		if (error == 0 && outsize > *outoffp &&
>+		    *outoffp <= OFF_MAX - len && outsize <= *outoffp + len &&
>+		    *inoffp < insize &&
>+		    *outoffp <= OFF_MAX - (insize - *inoffp) &&
>+		    outsize <= *outoffp + (insize - *inoffp)) {
> #ifdef MAC
> 			error = mac_vnode_check_write(curthread->td_ucred,
> 			    outcred, outvp);

Actions: View | Diff

Attachments on bug 276045: 247381 | 247804 | 247805