[PATCH v1 4/7] nfsd: keep spliced pages below rq_next_page when a READ fails

[Chuck Lever <cel@kernel.org>]

nfsd_splice_actor() replaces rq_respages entries with page cache
pages and advances rq_next_page past them. When
svc_encode_result_payload() then fails, nfsd4_encode_splice_read()
zeroes page_len, and nfsd4_encode_operation() computes rq_next_page
from the empty payload. svc_rqst_release_pages() and svc_alloc_arg()
handle only the entries below rq_next_page, so the spliced pages
stay in rq_respages. A later reply that encodes into those entries
overwrites the page cache of the file that was read.

svc_rdma_result_payload() returns -E2BIG when the READ payload is
larger than the Write chunk the client provided, so an NFS/RDMA
client can trigger the failure.

When an operation fails, do not move rq_next_page backward. A
successful operation still sets rq_next_page from the payload
length, because a short read through nfsd_iter_read() leaves
rq_next_page past pages the reply does not use.

Fixes: 76e5492b161f ("NFSD: Invoke svc_encode_result_payload() in "read" NFSD encoders")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 fs/nfsd/nfs4xdr.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index b86d181b58c3..d9417ebbe9db 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6804,7 +6804,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
 	next_page = xdr->buf->pages +
 		DIV_ROUND_UP(xdr->buf->page_base + xdr->buf->page_len,
 			     PAGE_SIZE);
-	rqstp->rq_next_page = min(next_page, rqstp->rq_page_end);
+	next_page = min(next_page, rqstp->rq_page_end);
+	/*
+	 * A failed splice read leaves page cache pages in rq_respages
+	 * above the truncated payload. Keep them below rq_next_page so
+	 * that svc_rqst_release_pages() releases them.
+	 */
+	if (!op->status || next_page > rqstp->rq_next_page)
+		rqstp->rq_next_page = next_page;
 }
 
 /**
-- 
2.55.0