[PATCH] SUNRPC: Honor page_base beyond the first page in xdr_buf_to_bvec()

[Chuck Lever <cel@kernel.org>]

xdr_buf_to_bvec() takes offset_in_page(page_base) but starts its
walk at pages[0], so the page index that page_base carries above
PAGE_SIZE is dropped. nfsd_direct_read() sets rq_res.page_base to
the pad below the file's DIO offset alignment. When that alignment
exceeds PAGE_SIZE, as with 8K to 64K logical blocks under xfs or
ext4 on a 4K-page NFSD, a direct READ whose pad reaches a full page
sends the page before the one that holds the data. The defect was
found by inspection, not reproduced.

Advance the page pointer by page_base >> PAGE_SHIFT before the walk.

Commit 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use
bio_vecs directly") introduced the dropped shift, but no caller
produced a page_base of a page or more until direct READ.

This fix depends at run time on nfsd4_encode_operation() deriving
rq_next_page from page_base as well as page_len. Otherwise the READ
encoder accounts for one page fewer than xdr_buf_to_bvec() now
transmits, and the last page sent sits outside the release range
while TCP still references the page.

Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
Cc: <stable@vger.kernel.org> # v6.19+
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 net/sunrpc/xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 7353109fdbae..7eef50634175 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -161,7 +161,7 @@ int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned int bvec_size,
 
 	if (xdr->page_len) {
 		unsigned int offset, len, remaining;
-		struct page **pages = xdr->pages;
+		struct page **pages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
 
 		offset = offset_in_page(xdr->page_base);
 		remaining = xdr->page_len;
-- 
2.56.0