NFSD: Fix reads with a non-zero offset that don't end on a page boundary

[ Upstream commit ac8db824ead0de2e9111337c401409d010fba2f0 ]

This was found when virtual machines with nfs-mounted qcow2 disks
failed to boot properly.

Reported-by: Anders Blomdell <anders.blomdell@control.lth.se>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142132
Fixes: bfbfb6182ad1 ("nfsd_splice_actor(): handle compound pages")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d17377148b669bf4a93c54d949b796976a9515da..9215350ad095c61d9e391db5097192a001467d95 100644 (file)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -872,11 +872,11 @@ nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
        struct svc_rqst *rqstp = sd->u.data;
        struct page *page = buf->page;  // may be a compound one
        unsigned offset = buf->offset;
-       int i;
+       struct page *last_page;
 
-       page += offset / PAGE_SIZE;
-       for (i = sd->len; i > 0; i -= PAGE_SIZE)
-               svc_rqst_replace_page(rqstp, page++);
+       last_page = page + (offset + sd->len - 1) / PAGE_SIZE;
+       for (page += offset / PAGE_SIZE; page <= last_page; page++)
+               svc_rqst_replace_page(rqstp, page);
        if (rqstp->rq_res.page_len == 0)        // first call
                rqstp->rq_res.page_base = offset % PAGE_SIZE;
        rqstp->rq_res.page_len += sd->len;