Re: [PATCH] nfsd: fix XDR tail bounds after spliced READ

[Chuck Lever]

On Sat, 31 Oct 2026 17:10:59 +0000, Jérémy Jean wrote:
> After a successful spliced READ, nfsd points the XDR tail at the
> unused bytes remaining in the first response page, so that later
> operation results are written into that space.
> nfsd4_encode_splice_read() correctly computes how much space is left
> there, but then moves xdr->end from its old value instead of using
> xdr->p. This gives the tail an incorrect size limit, which can cause
> an OOB write past the end of the page.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: fix XDR tail bounds after spliced READ
      commit: d650fb277960ef221f7fa2160072493aec418d65

--
Chuck Lever