Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Dan Aloni <dan@kernelim.com>
To:     linux-nfs@vger.kernel.org
Cc:     Trond Myklebust <trond.myklebust@hammerspace.com>
Subject: [PATCH] sunrpc: fix xs_read_xdr_buf for partial pages receive
Date:   Fri,  4 Dec 2020 20:34:19 +0200
Message-Id: <20201204183419.1532347-1-dan@kernelim.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

When receiving pages data, return value 'ret' when positive includes
`buf->page_base`, so we should subtract it similarly to how it is done
for `offset`.

This was discovered on the very rare cases where the server returned a
chunk of bytes that when added to the already received amount of bytes
for the pages happened to match the current `recv.len`, for example
on this case:

     buf->page_base : 258356
     actually received from socket: 1740
     ret : 260096
     want : 260096

In this case neither of the two 'if ... goto out' trigger, and we
continue to tail parsing.

Worth to mention that the ensuing EMSGSIZE from the continued execution of
`xs_read_xdr_buf` may be observed by an application due to 4 superfluous
bytes being added to the pages data.

Fixes: 277e4ab7d53 ("SUNRPC: Simplify TCP receive code by switching to
using iterators")
Signed-off-by: Dan Aloni <dan@kernelim.com>
---
 net/sunrpc/xprtsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7090bbee0ec5..42b680a60d38 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -436,7 +436,7 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
 		offset += ret - buf->page_base;
 		if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
 			goto out;
-		if (ret != want)
+		if (ret - buf->page_base != want)
 			goto out;
 		seek = 0;
 	} else {
-- 
2.26.2