NFSD: Update rq_next_page between COMPOUND operations
authorChuck Lever <chuck.lever@oracle.com>
Thu, 18 May 2023 17:45:50 +0000 (13:45 -0400)
committerChuck Lever <chuck.lever@oracle.com>
Sun, 11 Jun 2023 20:37:45 +0000 (16:37 -0400)
commited4a567a179ec15c15f78fa60ca6de9cc4f34897
tree02b219b7a15e64bfdcb3c40c9e74f46f7bcf4fa8
parentba21e20b309564c64761f4953db4456ec8c4e49c
NFSD: Update rq_next_page between COMPOUND operations

A GETATTR with a large result can advance xdr->page_ptr without
updating rq_next_page. If a splice READ follows that GETATTR in the
COMPOUND, nfsd_splice_actor can start splicing at the wrong page.

I've also seen READLINK and READDIR leave rq_next_page in an
unmodified state.

There are potentially a myriad of combinations like this, so play it
safe: move the rq_next_page update to nfsd4_encode_operation.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/nfs4xdr.c