⬢ DragonFlyBSD Kernel Audit
DF-3053 / fix.diff
← back to finding ↓ download raw
--- a/sys/vfs/nfs/nfsm_subs.c
+++ b/sys/vfs/nfs/nfsm_subs.c
@@ -1073,8 +1073,16 @@
 #endif
 			if (uiop->uio_segflg == UIO_SYSSPACE)
 				bcopy(mbufcp, uiocp, xfer);
-			else
-				copyout(mbufcp, uiocp, xfer);
+			else if (copyout(mbufcp, uiocp, xfer) != 0) {
+				/*
+				 * DF-3053: never swallow a copyout fault;
+				 * the read must report EFAULT instead of
+				 * claiming success with undelivered data.
+				 */
+				*mrep = mp;
+				*dpos = mbufcp;
+				return (EFAULT);
+			}
 			left -= xfer;
 			len -= xfer;
 			mbufcp += xfer;