CVE-2023-53083

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't replace page in rq_pages if it's a continuation of last page

The splice read calls nfsd_splice_actor to put the pages containing file

data into the svc_rqst->rq_pages array. It's possible however to get a

splice result that only has a partial page at the end, if (e.g.) the

filesystem hands back a short read that doesn't cover the whole page.

nfsd_splice_actor will plop the partial page into its rq_pages array and

return. Then later, when nfsd_splice_actor is called again, the

remainder of the page may end up being filled out. At this point,

nfsd_splice_actor will put the page into the array _again_ corrupting

the reply. If this is done enough times, rq_next_page will overrun the

array and corrupt the trailing fields -- the rq_respages and

rq_next_page pointers themselves.

If we've already added the page to the array in the last pass, don't add

it to the array a second time when dealing with a splice continuation.

This was originally handled properly in nfsd_splice_actor, but commit

91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check

for it.