CC-tea/coreutils
1
0
Fork 0
mirror of git://git.sv.gnu.org/coreutils.git synced 2026-02-10 17:31:56 +02:00
Code Issues Projects Releases Wiki Activity

copy: protect against infinite loop due to pathological race

Browse Source 
Consider:

1. In infer_scantype():
    - SEEK_DATA returns 0
      - hole punched at 0
    - SEEK_HOLE returns 0 (now a hole)
    - Cache scan_inference->hole_start = 0
2. In lseek_copy():
      - data written at 0
    - ext_start = 0, use cached hole_start = 0
    - ext_len = 0
    - now loop doesn't progress

* src/copy-file-data.c (lseek_copy): Apply a more defensive check
to ensure we only use the cached offsets in SCAN_INFERENCE once.
This protects against an infinite loop where an extent (at SRC_POS)
flip flops between data and hole extent while infer_scantype()
and lseek_copy() are inspecting it.  I.e. ensure we use SEEK_HOLE
to progress the copy.
This commit is contained in:
Pádraig Brady
2026-01-05 14:46:33 +00:00
parent c43f517e2a
commit 33bc44e1ba
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/copy-file-data.c
View File

@@ -335,12 +335,19 @@ lseek_copy (int src_fd, int dest_fd, char **abuf, idx_t buf_size,
debug->sparse_detection = COPY_DEBUG_EXTERNAL;
bool used_scan_inference = false;
for (off_t ext_start = scan_inference->ext_start;
0 <= ext_start && ext_start < max_ipos; )
{
off_t ext_end = (ext_start == src_pos
? scan_inference->hole_start
: lseek (src_fd, ext_start, SEEK_HOLE));
off_t ext_end;
if (ext_start == src_pos && ! used_scan_inference)
{
ext_end = scan_inference->hole_start;
used_scan_inference = true;
}
else
ext_end = lseek (src_fd, ext_start, SEEK_HOLE);
if (0 <= ext_end)
ext_end = MIN (ext_end, max_ipos);
else