[PATCH] nfsd: fix XDR tail bounds after spliced READ

[Jérémy Jean]

After a successful spliced READ, nfsd points the XDR tail at the
unused bytes remaining in the first response page, so that later
operation results are written into that space.
nfsd4_encode_splice_read() correctly computes how much space is left
there, but then moves xdr->end from its old value instead of using
xdr->p. This gives the tail an incorrect size limit, which can cause
an OOB write past the end of the page.

Keep the tail end at the current pointer plus the bounded remaining
space.

Fixes: 30596768b310 ("nfsd4: fix buflen calculation after read encoding")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 606ddcb085c0..2f92b6dfd92c 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5200,7 +5200,7 @@ static __be32 nfsd4_encode_splice_read(
 	space_left = min_t(int, (void *)xdr->end - (void *)xdr->p,
 				buf->buflen - buf->len);
 	buf->buflen = buf->len + space_left;
-	xdr->end = (__be32 *)((void *)xdr->end + space_left);
+	xdr->end = (__be32 *)((void *)xdr->p + space_left);
 
 	return nfs_ok;
 
-- 
2.47.3