[PATCH] NFSD: Refuse a direct READ whose aligned range exceeds the reply pages

[PATCH] NFSD: Refuse a direct READ whose aligned range exceeds the reply pages

[Chuck Lever]

nfsd_direct_read() expands the READ's byte range to the file's direct
I/O alignment, then maps reply pages until the range is covered or
rq_page_end is reached. A block device whose logical block size
exceeds PAGE_SIZE reports an alignment larger than PAGE_SIZE. With
16KB blocks and 4KB pages, a maximum-size READ at an offset that is
not a multiple of 16KB needs one more page than the svc_rqst has.
The loop stops at rq_page_end and passes a truncated iterator to the
filesystem. iomap rejects the unaligned length with -EINVAL, and NFSD
returns NFSERR_SERVERFAULT for a READ that a buffered read would have
satisfied.

Check the aligned range against the reply pages in
nfsd_direct_read_ok(), and fall back to a buffered read when the
range does not fit.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261109-xdr-page-base-v1-0-a4f4411d760d@kernel.org?part=11
Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 Documentation/filesystems/nfs/nfsd-io-modes.rst |  7 +++++++
 fs/nfsd/nfs4xdr.c                               |  5 -----
 fs/nfsd/trace.h                                 |  1 +
 fs/nfsd/vfs.c                                   | 14 ++++++++++++--
 4 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/Documentation/filesystems/nfs/nfsd-io-modes.rst b/Documentation/filesystems/nfs/nfsd-io-modes.rst
index d57b7916f6c2..28235eceb0c7 100644
--- a/Documentation/filesystems/nfs/nfsd-io-modes.rst
+++ b/Documentation/filesystems/nfs/nfsd-io-modes.rst
@@ -219,6 +219,13 @@ Tracing:
       nfsd_read_dio_pages_in_use  an earlier operation in the same
                                   COMPOUND already put data in the
                                   reply's pages
+      nfsd_read_dio_range_too_large
+                                  the DIO read offset alignment exceeds
+                                  the page size and the READ, expanded
+                                  to that alignment, needs more pages
+                                  than the reply has. An NFSv4 READ
+                                  that also meets one of the conditions
+                                  below reports that condition instead.
       nfsd_read_dio_head_full     an NFSv4 READ whose offset is not a
                                   multiple of four bytes, when the XDR
                                   stream has left the reply's head or
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 0b3d77bb9941..950c67362566 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5327,11 +5327,6 @@ static __be32 nfsd4_encode_splice_read(
 	return nfserr;
 }
 
-/*
- * Reply-buffer checks that nfsd_direct_read_ok() cannot make: the
- * payload's placement depends on the alignment pad, and the pad on the
- * READ offset.
- */
 static bool nfsd4_direct_read_fits(struct nfsd4_compoundres *resp,
 				   struct nfsd4_read *read,
 				   unsigned long count)
diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
index 11a6d7d66f6f..45a5db9def39 100644
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -662,6 +662,7 @@ DEFINE_EVENT(nfsd_read_dio_class, nfsd_read_dio_##name,		\
 DEFINE_NFSD_READ_DIO_EVENT(no_alignment);
 DEFINE_NFSD_READ_DIO_EVENT(too_small);
 DEFINE_NFSD_READ_DIO_EVENT(pages_in_use);
+DEFINE_NFSD_READ_DIO_EVENT(range_too_large);
 DEFINE_NFSD_READ_DIO_EVENT(head_full);
 DEFINE_NFSD_READ_DIO_EVENT(reply_full);
 DEFINE_NFSD_READ_DIO_EVENT(not_last_op);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 10ea334cfdab..123c38f3bd88 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1250,9 +1250,11 @@ nfsd_direct_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
 
 static bool nfsd_direct_read_ok(struct svc_rqst *rqstp, struct svc_fh *fhp,
 				struct nfsd_file *nf, loff_t offset,
-				unsigned long count, bool dio_ok)
+				unsigned long count, struct page **page,
+				bool dio_ok)
 {
 	u32 offset_align = nf->nf_dio_read_offset_align;
+	u64 dio_len;
 
 	/* When dio_read_offset_align is zero, dio is not supported */
 	if (!offset_align) {
@@ -1273,6 +1275,14 @@ static bool nfsd_direct_read_ok(struct svc_rqst *rqstp, struct svc_fh *fhp,
 	}
 	if (!dio_ok)
 		return false;
+	/* An alignment above PAGE_SIZE can round the range past rq_page_end */
+	dio_len = round_up((u64)offset + count, offset_align) -
+		  round_down(offset, offset_align);
+	if ((s64)dio_len > (s64)PAGE_SIZE * (rqstp->rq_page_end - page)) {
+		trace_nfsd_read_dio_range_too_large(rqstp, fhp, offset, count,
+						    offset_align);
+		return false;
+	}
 	return true;
 }
 
@@ -1356,7 +1366,7 @@ __be32 nfsd_iter_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
 		break;
 	case NFSD_IO_DIRECT:
 		if (nfsd_direct_read_ok(rqstp, fhp, nf, offset, *count,
-					dio_ok))
+					page, dio_ok))
 			return nfsd_direct_read(rqstp, fhp, nf, offset,
 						count, page, eof,
 						storage_start);
-- 
2.56.0

Re: NFSD: Refuse a direct READ whose aligned range exceeds the reply pages

[Mike Snitzer]

On Wed, Nov 11, 2026 at 10:20:50AM -0500, Chuck Lever wrote:
> nfsd_direct_read() expands the READ's byte range to the file's direct
> I/O alignment, then maps reply pages until the range is covered or
> rq_page_end is reached. A block device whose logical block size
> exceeds PAGE_SIZE reports an alignment larger than PAGE_SIZE. With
> 16KB blocks and 4KB pages, a maximum-size READ at an offset that is
> not a multiple of 16KB needs one more page than the svc_rqst has.
> The loop stops at rq_page_end and passes a truncated iterator to the
> filesystem. iomap rejects the unaligned length with -EINVAL, and NFSD
> returns NFSERR_SERVERFAULT for a READ that a buffered read would have
> satisfied.
> 
> Check the aligned range against the reply pages in
> nfsd_direct_read_ok(), and fall back to a buffered read when the
> range does not fit.
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20261109-xdr-page-base-v1-0-a4f4411d760d@kernel.org?part=11
> Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
> Signed-off-by: Chuck Lever <cel@kernel.org>

Reviewed-by: Mike Snitzer <snitzer@kernel.org>