[PATCH] SUNRPC: Honor page_base beyond the first page in xdr_buf_to_bvec()

[PATCH] SUNRPC: Honor page_base beyond the first page in xdr_buf_to_bvec()

[Chuck Lever]

xdr_buf_to_bvec() takes offset_in_page(page_base) but starts its
walk at pages[0], so the page index that page_base carries above
PAGE_SIZE is dropped. nfsd_direct_read() sets rq_res.page_base to
the pad below the file's DIO offset alignment. When that alignment
exceeds PAGE_SIZE, as with 8K to 64K logical blocks under xfs or
ext4 on a 4K-page NFSD, a direct READ whose pad reaches a full page
sends the page before the one that holds the data. The defect was
found by inspection, not reproduced.

Advance the page pointer by page_base >> PAGE_SHIFT before the walk.

Commit 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use
bio_vecs directly") introduced the dropped shift, but no caller
produced a page_base of a page or more until direct READ.

This fix depends at run time on nfsd4_encode_operation() deriving
rq_next_page from page_base as well as page_len. Otherwise the READ
encoder accounts for one page fewer than xdr_buf_to_bvec() now
transmits, and the last page sent sits outside the release range
while TCP still references the page.

Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
Cc: <stable@vger.kernel.org> # v6.19+
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 net/sunrpc/xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 7353109fdbae..7eef50634175 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -161,7 +161,7 @@ int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned int bvec_size,
 
 	if (xdr->page_len) {
 		unsigned int offset, len, remaining;
-		struct page **pages = xdr->pages;
+		struct page **pages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
 
 		offset = offset_in_page(xdr->page_base);
 		remaining = xdr->page_len;
-- 
2.56.0

Re: [PATCH] SUNRPC: Honor page_base beyond the first page in xdr_buf_to_bvec()

[Chuck Lever]

On Fri, Nov 6, 2026, at 10:01 AM, Chuck Lever wrote:
> xdr_buf_to_bvec() takes offset_in_page(page_base) but starts its
> walk at pages[0], so the page index that page_base carries above
> PAGE_SIZE is dropped. nfsd_direct_read() sets rq_res.page_base to
> the pad below the file's DIO offset alignment. When that alignment
> exceeds PAGE_SIZE, as with 8K to 64K logical blocks under xfs or
> ext4 on a 4K-page NFSD, a direct READ whose pad reaches a full page
> sends the page before the one that holds the data. The defect was
> found by inspection, not reproduced.
>
> Advance the page pointer by page_base >> PAGE_SHIFT before the walk.
>
> Commit 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use
> bio_vecs directly") introduced the dropped shift, but no caller
> produced a page_base of a page or more until direct READ.
>
> This fix depends at run time on nfsd4_encode_operation() deriving
> rq_next_page from page_base as well as page_len. Otherwise the READ
> encoder accounts for one page fewer than xdr_buf_to_bvec() now
> transmits, and the last page sent sits outside the release range
> while TCP still references the page.
>
> Fixes: d686e64e931c ("NFSD: Implement NFSD_IO_DIRECT for NFS READ")
> Cc: <stable@vger.kernel.org> # v6.19+
> Signed-off-by: Chuck Lever <cel@kernel.org>
> ---
>  net/sunrpc/xdr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
> index 7353109fdbae..7eef50634175 100644
> --- a/net/sunrpc/xdr.c
> +++ b/net/sunrpc/xdr.c
> @@ -161,7 +161,7 @@ int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned 
> int bvec_size,
> 
>  	if (xdr->page_len) {
>  		unsigned int offset, len, remaining;
> -		struct page **pages = xdr->pages;
> +		struct page **pages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
> 
>  		offset = offset_in_page(xdr->page_base);
>  		remaining = xdr->page_len;
> -- 
> 2.56.0

To address the sashiko.dev finding for this patch, I've folded this fix into
"nfsd: account for page_base when advancing rq_next_page" which is currently
in nfsd-next.


-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)