[PATCH] Fix unsigned underflow in xdr decoding.

With 'len' being unsigned now, we must make sure it never tries
to go negative...

Thanks: griffon26@kfk4ever.com (Maurice van der Pot)

Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 9764dfa1c5631985b9020106810260a5768e3dc0..e7f907dfa2b95310f51ff22753f07a6346ea35e6 100644 (file)
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -347,8 +347,8 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
                svc_take_page(rqstp);
                args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
                args->vec[v].iov_len = len < PAGE_SIZE? len : PAGE_SIZE;
+               len -= args->vec[v].iov_len;
                v++;
-               len -= PAGE_SIZE;
        }
        args->vlen = v;
        return xdr_argsize_check(rqstp, p);

diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index d978123a68670376c22b0a958a43fb36721e95a1..948b08287c990015c2ddde9854faa72bba43a21a 100644 (file)
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -255,8 +255,8 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
                svc_take_page(rqstp);
                args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
                args->vec[v].iov_len = len < PAGE_SIZE?len:PAGE_SIZE;
+               len -= args->vec[v].iov_len;
                v++;
-               len -= PAGE_SIZE;
        }
        args->vlen = v;
        return xdr_argsize_check(rqstp, p);