diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2022-11-23 14:14:32 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-06-21 14:54:04 +0200 |
| commit | 7ea635fc47af797fea5250fcba22acc4c159e4de (patch) | |
| tree | 1a48841b18d6c3a6601c971a31e55448cb194f4d | |
| parent | 7d867c6c30e1c5abd7ef01418108af9911163a67 (diff) | |
| download | linux-stable-7ea635fc47af797fea5250fcba22acc4c159e4de.tar.gz linux-stable-7ea635fc47af797fea5250fcba22acc4c159e4de.tar.bz2 linux-stable-7ea635fc47af797fea5250fcba22acc4c159e4de.zip | |
NFSD: Fix reads with a non-zero offset that don't end on a page boundary
[ Upstream commit ac8db824ead0de2e9111337c401409d010fba2f0 ]
This was found when virtual machines with nfs-mounted qcow2 disks
failed to boot properly.
Reported-by: Anders Blomdell <anders.blomdell@control.lth.se>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142132
Fixes: bfbfb6182ad1 ("nfsd_splice_actor(): handle compound pages")
[ cel: "‘for’ loop initial declarations are only allowed in C99 or C11 mode" ]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/nfsd/vfs.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index e29034b1e612..4ff626c912cc 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -888,11 +888,11 @@ nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf, struct svc_rqst *rqstp = sd->u.data; struct page *page = buf->page; // may be a compound one unsigned offset = buf->offset; - int i; + struct page *last_page; - page += offset / PAGE_SIZE; - for (i = sd->len; i > 0; i -= PAGE_SIZE) - svc_rqst_replace_page(rqstp, page++); + last_page = page + (offset + sd->len - 1) / PAGE_SIZE; + for (page += offset / PAGE_SIZE; page <= last_page; page++) + svc_rqst_replace_page(rqstp, page); if (rqstp->rq_res.page_len == 0) // first call rqstp->rq_res.page_base = offset % PAGE_SIZE; rqstp->rq_res.page_len += sd->len; |