copy: fix possible infinite loop with SEEK_HOLE

Commit v9.8-95-g4c0cf3864 intended to initialize
ext_start to src_pos, as was described at:
https://lists.gnu.org/r/coreutils/2025-11/msg00035.html
However ipos was inadvertently used, which is only
valid the first time through the loop.

* src/copy-file-data.c (lseek_copy): Use scan_inference->hole_start
only with the initial offset passed to lseek_copy().
* NEWS: Mention the bug fix.
Reported at https://github.com/coreutils/coreutils/issues/159

diff --git a/NEWS b/NEWS
index e3858a8550b0f5e171b7f1816f0e9a314995c6e2..ca13267b3c85898ca34cfd97dd4c7046339140c5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,11 @@ GNU coreutils NEWS                                    -*- outline -*-
 
 ** Bug fixes
 
+  cp, install, and mv no longer enter an infinite loop copying sparse files
+  with SEEK_HOLE.  E.g., this was seen on ext4 when copying sparse files with
+  extents that are being actively updated, and copy offload is not being used.
+  [bug introduced in coreutils-9.9]
+
   'date' no longer fails with format directives that return an empty string.
   [bug introduced in coreutils-9.9]
 

diff --git a/src/copy-file-data.c b/src/copy-file-data.c
index 927a6e04801b942eb3f0502292214621875eb309..56b669fe7267d9027714eae5b8816a3c2de2ec2b 100644 (file)
--- a/src/copy-file-data.c
+++ b/src/copy-file-data.c
@@ -338,7 +338,7 @@ lseek_copy (int src_fd, int dest_fd, char **abuf, idx_t buf_size,
   for (off_t ext_start = scan_inference->ext_start;
        0 <= ext_start && ext_start < max_ipos; )
     {
-      off_t ext_end = (ext_start == ipos
+      off_t ext_end = (ext_start == src_pos
                        ? scan_inference->hole_start
                        : lseek (src_fd, ext_start, SEEK_HOLE));
       if (0 <= ext_end)