[RFC PATCH] xprtrdma: Fix Write chunk payload corruption on a short reply header

[Chuck Lever <cel@kernel.org>]

RFC 1813 lets an NFSv3 server return READ3resok with
attributes_follow set to FALSE. The client reserves room in the head
iovec for the largest possible reply header, so the inline part of
such a reply falls short of that reservation by the 21 words of the
omitted fattr3. rpcrdma_inline_fixup() repoints the head iovec at
the received message but leaves its length at the reservation, so
the last 84 bytes of the iovec cover stale receive buffer content.

xdr_realign_pages() finds a head iovec longer than the decode
position and takes the difference for reply data.
xdr_shrink_bufhead() shifts those bytes into the page list, so the
READ returns transport data where the first 84 bytes of file content
belong. An ordinary NFSv3 mount corrupts only the first READ,
because nfs3_read_done() records the shorter header size for
subsequent calls. A FlexFiles NFSv3 data server corrupts every READ,
because the layout driver installs its own completion callback and
nfs3_read_done() skips that bookkeeping.

Reduce the head iovec to the number of bytes actually received when
a Write chunk carried the payload. Commit cb0ae1fbb2f5 ("xprtrdma:
Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
dropped that adjustment while repairing krb5p reply decoding. An
authentication flavor that touches the payload cannot use a Write
chunk, so restoring the adjustment only for Write chunks leaves the
krb5p repair alone.

Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Reported-by: Rakesh Bhargava <Rakesh.Bhargava@netapp.com>
Closes: https://lore.kernel.org/linux-nfs/SA6PR06MB104695205126871E29444567A8BA02@SA6PR06MB10469.namprd06.prod.outlook.com/
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 net/sunrpc/xprtrdma/rpc_rdma.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Note: Compile-tested only.


diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 1285f04cdac1..42698a2622a4 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1244,6 +1244,16 @@ rpcrdma_decode_msg(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
 	/* Build the RPC reply's Payload stream in rqst->rq_rcv_buf */
 	base = (char *)xdr_inline_decode(xdr, 0);
 	rpclen = xdr_stream_remaining(xdr);
+
+	/* The head iovec is sized for a maximum-length reply header.
+	 * Leaving its length unadjusted lets xdr_realign_pages() shift
+	 * stale receive buffer bytes over the Write chunk payload.
+	 */
+	if (writelist && rpclen < rqst->rq_rcv_buf.head[0].iov_len) {
+		rqst->rq_rcv_buf.head[0].iov_len = rpclen;
+		rqst->rq_private_buf.head[0].iov_len = rpclen;
+	}
+
 	r_xprt->rx_stats.fixup_copy_count +=
 		rpcrdma_inline_fixup(rqst, base, rpclen, writelist & 3);
 
-- 
2.54.0