NFSD: Insulate nfsd4_encode_read_plus() from page boundaries in the encode buffer

JIRA: https://issues.redhat.com/browse/RHEL-108616

commit c9fc777
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Mon Dec 30 19:28:54 2024 -0500

    NFSD: Insulate nfsd4_encode_read_plus() from page boundaries in the encode buffer

    Commit eeadcb7 ("NFSD: Simplify READ_PLUS") replaced the use of
    write_bytes_to_xdr_buf(), copying what was in nfsd4_encode_read()
    at the time.

    However, the current code will corrupt the encoded data if the XDR
    data items that are reserved early and then poked into the XDR
    buffer later happen to fall on a page boundary in the XDR encoding
    buffer.

    __xdr_commit_encode can shift encoded data items in the encoding
    buffer so that pointers returned from xdr_reserve_space() no longer
    address the same part of the encoding stream.

    Fixes: eeadcb7 ("NFSD: Simplify READ_PLUS")
    Reviewed-by: NeilBrown <neilb@suse.de>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

Signed-off-by: Benjamin Coddington <bcodding@redhat.com>

Author: bcodding-rh

fs/nfsd/nfs4xdr.c

@@ -5323,16 +5323,17 @@ nfsd4_encode_read_plus(struct nfsd4_compoundres *resp, __be32 nfserr,
 	struct nfsd4_read *read = &u->read;
 	struct file *file = read->rd_nf->nf_file;
 	struct xdr_stream *xdr = resp->xdr;
-	int starting_len = xdr->buf->len;
+	unsigned int eof_offset;
+	__be32 wire_data[2];
 	u32 segments = 0;
-	__be32 *p;
 
 	if (nfserr)
 		return nfserr;
 
-	/* eof flag, segment count */
-	p = xdr_reserve_space(xdr, 4 + 4);
-	if (!p)
+	eof_offset = xdr->buf->len;
+
+	/* Reserve space for the eof flag and segment count */
+	if (unlikely(!xdr_reserve_space(xdr, XDR_UNIT * 2)))
 		return nfserr_io;
 	xdr_commit_encode(xdr);
 
@@ -5342,15 +5343,16 @@ nfsd4_encode_read_plus(struct nfsd4_compoundres *resp, __be32 nfserr,
 
 	nfserr = nfsd4_encode_read_plus_data(resp, read);
 	if (nfserr) {
-		xdr_truncate_encode(xdr, starting_len);
+		xdr_truncate_encode(xdr, eof_offset);
 		return nfserr;
 	}
 
 	segments++;
 
 out:
-	p = xdr_encode_bool(p, read->rd_eof);
-	*p = cpu_to_be32(segments);
+	wire_data[0] = read->rd_eof ? xdr_one : xdr_zero;
+	wire_data[1] = cpu_to_be32(segments);
+	write_bytes_to_xdr_buf(xdr->buf, eof_offset, &wire_data, XDR_UNIT * 2);
 	return nfserr;
 }