SUNRPC: Don't decode beyond the end of the RPC reply message

Now that xdr_inline_decode() will automatically cross into the page
buffers, we need to ensure that it doesn't exceed the total reply
message length.

This patch sets up a counter that tracks the number of words
remaining in the reply message, and ensures that xdr_inline_decode,
xdr_read_pages and xdr_enter_page respect the end of message boundary.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index af70af333546..f1e7f884d1c3 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -205,6 +205,7 @@ struct xdr_stream {
         struct kvec *iov;       /* pointer to the current kvec */
         struct kvec scratch;    /* Scratch buffer */
         struct page **page_ptr; /* pointer to the current page */
+        unsigned int nwords;    /* Remaining decode buffer length */
 };
 
 /*