CVE-2023-53360

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: Rework scratch handling for READ_PLUS (again)

I found that the read code might send multiple requests using the same

nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is

how we ended up occasionally double-freeing the scratch buffer, but also

means we set a NULL pointer but non-zero length to the xdr scratch

buffer. This results in an oops the first time decoding needs to copy

something to scratch, which frequently happens when decoding READ_PLUS

hole segments.

I fix this by moving scratch handling into the pageio read code. I

provide a function to allocate scratch space for decoding read replies,

and free the scratch buffer when the nfs_pgio_header is freed.