Re: [PATCH] svcrdma: account for inline bytes in Read chunk page budget

[Chuck Lever]

On Thu, 15 Oct 2026 22:58:32 +0900, Jiwoong Wi wrote:
> The Read-list check limits Read bytes to the request page budget. With
> multiple data item Read chunks, svc_rdma_read_multiple_chunks() copies
> the inline RPC body into those same pages. The reconstructed message
> can overflow the budget even when its Read bytes alone fit.
> 
> A short final Read segment escapes the existing page-overrun check
> because that check runs only if len remains nonzero. The inflated
> rc_page_count then makes svc_rdma_clear_rqst_pages() write past
> rc_pages, followed by an out-of-bounds read during cleanup.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] svcrdma: account for inline bytes in Read chunk page budget
      commit: 4e84914d70a0194e18bba6d814cfe71b340aadc8

--
Chuck Lever