Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "J. Bruce Fields" <bfields@fieldses.org>
Cc:     "Chuck Lever" <chuck.lever@oracle.com>, linux-nfs@vger.kernel.org
Subject: Re: [PATCH v1 1/5] SUNRPC: Fix the calculation of xdr->end in
 xdr_get_next_encode_buffer()
In-reply-to: <20220606220938.GE15057@fieldses.org>
References: <165445865736.1664.4497130284832282034.stgit@bazille.1015granger.net>,
 <165445910560.1664.5852151724543272982.stgit@bazille.1015granger.net>,
 <20220606220938.GE15057@fieldses.org>
Date:   Tue, 07 Jun 2022 10:59:25 +1000
Message-id: <165456356541.22243.8883363674329684173@noble.neil.brown.name>
Precedence: bulk

On Tue, 07 Jun 2022, J. Bruce Fields wrote:
> On Sun, Jun 05, 2022 at 03:58:25PM -0400, Chuck Lever wrote:
> > I found that NFSD's new NFSv3 READDIRPLUS XDR encoder was screwing up
> > right at the end of the page array. xdr_get_next_encode_buffer() does
> > not compute the value of xdr->end correctly:
> >=20
> >  * The check to see if we're on the final available page in xdr->buf
> >    needs to account for the space consumed by @nbytes.
> >=20
> >  * The new xdr->end value needs to account for the portion of @nbytes
> >    that is to be encoded into the previous buffer.
> >=20
> > Fixes: 2825a7f90753 ("nfsd4: allow encoding across page boundaries")
> > Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> > ---
> >  net/sunrpc/xdr.c |    6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >=20
> > diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
> > index df194cc07035..b57cf9df4de8 100644
> > --- a/net/sunrpc/xdr.c
> > +++ b/net/sunrpc/xdr.c
> > @@ -979,7 +979,11 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr=
_stream *xdr,
> >  	 */
> >  	xdr->p =3D (void *)p + frag2bytes;
> >  	space_left =3D xdr->buf->buflen - xdr->buf->len;
> > -	xdr->end =3D (void *)p + min_t(int, space_left, PAGE_SIZE);
> > +	if (space_left - nbytes >=3D PAGE_SIZE)
> > +		xdr->end =3D (void *)p + PAGE_SIZE;
> > +	else
> > +		xdr->end =3D (void *)p + space_left - frag1bytes;
> > +
>=20
> I think that's right.

I think I agree.

>=20
> Couldn't you just make that
>=20
>=20
> -	xdr->end =3D (void *)p + min_t(int, space_left, PAGE_SIZE);
> +	xdr->end =3D (void *)p + min_t(int, space_left - nbytes, PAGE_SIZE);

I don't think that is the same.
When space_left is small, this results in "p + space_left - nbytes" but
the one we both this is right results in  "p + space_left - frag1bytes".

I'm going to suggest a more radical change.
Let's start off with=20

   int space_avail =3D xdr->buf->buflen - xdr->buf->len;

In this function we sometime care about space before we consume any, and
something care about space after we consume some.  "space_left" sounds
more like the latter.  "space_avail" sounds more like the former.
Current space_left is assigned to the former, which I find confused.

Then the second "if" which Bruce highlighted becomes

   if (nbytes > space_avail)
          goto out_overflow;

which is obviously correct.

We then assign frag{1,2}bytes and have another chunk of code that looks
wrong to me.  I'd like

   if (xdr->iov) {
	xdr->iov->iov_len +=3D frag1bytes;
	xdr->iov =3D NULL;
   } else {
        xdr->buf->page_len +=3D frag1bytes;
        xdr->page_ptr++;
   }

Note that this changes the code NOT to increment pagE_ptr if iov was not
NULL.  I cannot see how it would be correct to do that.  Presumably this
code is never called with iov !=3D NULL ???

Now I want to rearrange the assignments at the end:

	xdr->p =3D (void *)p + frag2bytes;
	xdr->buf->page_len +=3D frag2bytes;
	xdr->buf->len +=3D nbytes;
	space_left =3D xdr->buf->buflen - xdr->buf->len;
	xdr->end =3D (void *)xdr->p + min_t(int, space_left, PAGE_SIZE);

Note that the last line "xdr->p" in place of "p".
We still have "space_left", but it now is the space that is left
after we have consumed some.

Possibly the space_left line could be

       space_left -=3D nbytes;

NeilBrown

>=20
> ?
>=20
> (Note we know space_left >=3D nbytes from the second "if" of this
> function.)
>=20
> No strong opinion either way, really, I just wonder if I'm missing
> something.
>=20
> --b.
>=20
> >  	xdr->buf->page_len +=3D frag2bytes;
> >  	xdr->buf->len +=3D nbytes;
> >  	return p;
> >=20
>=20