[PATCH v1 2/7] nfsd: account for page_base when advancing rq_next_page

[Chuck Lever <cel@kernel.org>]

nfsd4_encode_operation() sets rq_next_page from xdr->page_ptr, which
the xdr_stream advances from page_len alone. A direct read leaves the
payload at a nonzero page_base, so its last page can lie beyond the
page xdr->page_ptr names. svc_rqst_release_pages() then skips that
page, and svc_alloc_arg() hands it to the next request as a receive
buffer while the transport still references it. svc_tcp_sendmsg()
splices the page into the socket without copying it, and svcrdma
keeps only the pages below rq_next_page until Send completion. The
tail of the READ payload reaches the client overwritten with bytes
of the next request.

Derive rq_next_page from page_base and page_len, the accounting that
xdr_truncate_encode() and the transports use to locate the payload.

Currently nfsd_direct_read() stores its alignment pad in page_base
even when the read returns no payload, and the pad can exceed the
size of the rq_respages array. Set page_base only when the read
returns payload, so that the new calculation stays within the pages
offered to the read.

Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 fs/nfsd/nfs4xdr.c | 12 +++++++++---
 fs/nfsd/vfs.c     |  7 ++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 7062c84f96dd..89230b3206ac 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6714,6 +6714,7 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
 	struct svc_rqst *rqstp = resp->rqstp;
 	const struct nfsd4_operation *opdesc = op->opdesc;
 	unsigned int op_status_offset;
+	struct page **next_page;
 	nfsd4_enc encoder;
 
 	/*
@@ -6800,10 +6801,15 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
 			       &op->status, XDR_UNIT);
 release:
 	/*
-	 * Account for pages consumed while encoding this operation.
-	 * The xdr_stream primitives don't manage rq_next_page.
+	 * Account for pages consumed while encoding this operation. The
+	 * xdr_stream primitives don't manage rq_next_page, and
+	 * xdr->page_ptr does not account for page_base. XDR padding can
+	 * carry page_base + page_len past rq_page_end.
 	 */
-	rqstp->rq_next_page = xdr->page_ptr + 1;
+	next_page = xdr->buf->pages +
+		DIV_ROUND_UP(xdr->buf->page_base + xdr->buf->page_len,
+			     PAGE_SIZE);
+	rqstp->rq_next_page = min(next_page, rqstp->rq_page_end);
 }
 
 /**
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index e052b9163692..3f328378c805 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1143,9 +1143,6 @@ nfsd_direct_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
 	if (host_err >= 0) {
 		unsigned int pad = offset - dio_start;
 
-		/* The returned payload starts after the pad */
-		rqstp->rq_res.page_base = pad;
-
 		/* Compute the count of bytes to be returned */
 		if (host_err > pad + *count)
 			host_err = *count;
@@ -1153,6 +1150,10 @@ nfsd_direct_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
 			host_err -= pad;
 		else
 			host_err = 0;
+
+		/* The returned payload starts after the pad */
+		if (host_err)
+			rqstp->rq_res.page_base = pad;
 	} else if (unlikely(host_err == -EINVAL)) {
 		struct inode *inode = d_inode(fhp->fh_dentry);
 
-- 
2.55.0