xprtrdma: Fix Write chunk payload corruption on a short reply header

An NFSv3 server may return READ3resok with attributes_follow set to
FALSE. The client has already reserved enough head iovec space for
the largest possible reply header, so such a reply falls 84 bytes
short of that estimate.

rpcrdma_inline_fixup() points the head iovec at the received message
but leaves its length at the reserved size, so it runs past the header
into stale receive buffer content. xdr_realign_pages() then shifts
those bytes into the page list, and the READ returns transport data
where READ payload belongs.

nfs3_read_done() records the shorter header size, so on an ordinary
NFSv3 mount, only the first READ is corrupted. However, the FlexFiles
layout driver installs its own completion callback, so every READ
from a data server is corrupt.

To address this, reduce the head iovec to the header bytes actually
received when a Write chunk carries the READ payload. An auth flavor
that transforms the payload cannot use a Write chunk, so scoping it
to Write chunks leaves krb5[ip] alone.

Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Reported-by: Rakesh Bhargava <Rakesh.Bhargava@netapp.com>
Closes: https://lore.kernel.org/linux-nfs/SA6PR06MB104695205126871E29444567A8BA02@SA6PR06MB10469.namprd06.prod.outlook.com/
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

0 files changed, 0 insertions, 0 deletions