UPSTREAM: nfsd: stricter decoding of write-like NFSv2/v3 ops

The NFSv2/v3 code does not systematically check whether we decode past
the end of the buffer.  This generally appears to be harmless, but there
are a few places where we do arithmetic on the pointers involved and
don't account for the possibility that a length could be negative.  Add
checks to catch these.

Reported-by: Tuomas Haanp <thaan@synopsys.com>
Reported-by: Ari Kauppi <ari@synopsys.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Andrey Ulanov <andreyu@google.com>

(cherry picked from commit 13bf9fbff0e5e099e2b6f003a0ab8ae145436309)

BUG=b:38261521
TEST=None

Change-Id: Iba805f76c8e0f6d98374f877f8bfd36ea8dc5718
Previous-Reviewed-on: https://chromium-review.googlesource.com/506275
(cherry picked from commit 0d70c878e0a0aa227c6785a64f80ce0b07fa0ba8)
Reviewed-on: https://chromium-review.googlesource.com/508058
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
2 files changed