tree 7978b567fd46b4d8c265ed98983bf4b7ce756889
parent 1352148aca8c814a77e3d7c7f6f841efe768d234
author J. Bruce Fields <bfields@redhat.com> 1492802790 -0400
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1494872151 +0000

UPSTREAM: nfsd: stricter decoding of write-like NFSv2/v3 ops

The NFSv2/v3 code does not systematically check whether we decode past
the end of the buffer.  This generally appears to be harmless, but there
are a few places where we do arithmetic on the pointers involved and
don't account for the possibility that a length could be negative.  Add
checks to catch these.

Reported-by: Tuomas Haanpää <thaan@synopsys.com>
Reported-by: Ari Kauppi <ari@synopsys.com>
Reviewed-by: NeilBrown <neilb@suse.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Andrey Ulanov <andreyu@google.com>

(cherry picked from commit 13bf9fbff0e5e099e2b6f003a0ab8ae145436309)

BUG=b:38261521
TEST=None

Change-Id: Iba805f76c8e0f6d98374f877f8bfd36ea8dc5718
Reviewed-on: https://chromium-review.googlesource.com/506275
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>