A slightly modified take on Jeff's earlier patches, tested with
both NFSv3 and NFSv4.1 via simple fault injection in
svc_rqst_replace_page().

In general I'm in favor of more rq_pages bounds checking by
replacing direct modification of the rq_respages and rq_next_page
fields with accessor functions.

---

Chuck Lever (2):
      SUNRPC: add bounds checking to svc_rqst_replace_page
      NFSD: Watch for rq_pages bounds checking errors in nfsd_splice_actor()

Jeff Layton (1):
      nfsd: don't replace page in rq_pages if it's a continuation of last page


 fs/nfsd/vfs.c                 | 15 +++++++++++++--
 include/linux/sunrpc/svc.h    |  2 +-
 include/trace/events/sunrpc.h | 25 +++++++++++++++++++++++++
 net/sunrpc/svc.c              | 15 ++++++++++++++-
 4 files changed, 53 insertions(+), 4 deletions(-)

--
Chuck Lever