UPSTREAM: nfsd: stricter decoding of write-like NFSv2/v3 ops

The NFSv2/v3 code does not systematically check whether we decode past
the end of the buffer.  This generally appears to be harmless, but there
are a few places where we do arithmetic on the pointers involved and
don't account for the possibility that a length could be negative.  Add
checks to catch these.

Reported-by: Tuomas Haanp <>
Reported-by: Ari Kauppi <>
Signed-off-by: J. Bruce Fields <>
Signed-off-by: Andrey Ulanov <>

(cherry picked from commit 13bf9fbff0e5e099e2b6f003a0ab8ae145436309)


Change-Id: Iba805f76c8e0f6d98374f877f8bfd36ea8dc5718
(cherry picked from commit 0d70c878e0a0aa227c6785a64f80ce0b07fa0ba8)
Reviewed-by: Guenter Roeck <>
Commit-Queue: Andrey Ulanov <>
Tested-by: Andrey Ulanov <>
2 files changed