3 files changed, 8 insertions, 2 deletions

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7a79c23aa6d4..ea855629a1c2 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -822,7 +822,8 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, unsigned long offset
                 rqstp->rq_res.page_len = size;
         } else if (page != pp[-1]) {
                 get_page(page);
-                put_page(*pp);
+                if (*pp)
+                        put_page(*pp);
                 *pp = page;
                 rqstp->rq_resused++;
                 rqstp->rq_res.page_len += size;
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 965d6c20086e..64f3d60c72af 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -144,8 +144,11 @@ extern u32 svc_max_payload(const struct svc_rqst *rqstp);
  *
  * Each request/reply pair can have at most one "payload", plus two pages,
  * one for the request, and one for the reply.
+ * We using ->sendfile to return read data, we might need one extra page
+ * if the request is not page-aligned.  So add another '1'.
  */
-#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
+#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE \
+                                + 2 + 1)
 
 static inline u32 svc_getnl(struct kvec *iov)
 {
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 99f54fb6d669..45120f268d03 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1278,6 +1278,8 @@ svc_recv(struct svc_rqst *rqstp, long timeout)
                                 schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                         rqstp->rq_pages[i] = p;
                 }
+        rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
+        BUG_ON(pages >= RPCSVC_MAXPAGES);
 
         /* Make arg->head point to first page and arg->pages point to rest */
         arg = &rqstp->rq_arg;