A slightly modified take on Jeff's earlier patches, tested with both NFSv3 and NFSv4.1 via simple fault injection in svc_rqst_replace_page(). In general I'm in favor of more rq_pages bounds checking by replacing direct modification of the rq_respages and rq_next_page fields with accessor functions. --- Chuck Lever (2): SUNRPC: add bounds checking to svc_rqst_replace_page NFSD: Watch for rq_pages bounds checking errors in nfsd_splice_actor() Jeff Layton (1): nfsd: don't replace page in rq_pages if it's a continuation of last page fs/nfsd/vfs.c | 15 +++++++++++++-- include/linux/sunrpc/svc.h | 2 +- include/trace/events/sunrpc.h | 25 +++++++++++++++++++++++++ net/sunrpc/svc.c | 15 ++++++++++++++- 4 files changed, 53 insertions(+), 4 deletions(-) -- Chuck Lever