Merge branch 'for-3.11' of git://linux-nfs.org/~bfields/linux

Pull nfsd bugfixes from Bruce Fields:
 "Just three minor bugfixes"

* 'for-3.11' of git://linux-nfs.org/~bfields/linux:
  svcrdma: underflow issue in decode_write_list()
  nfsd4: fix minorversion support interface
  lockd: protect nlm_blocked access in nlmsvc_retry_blocked

1 files changed, 14 insertions, 6 deletions

diff --git a/net/sunrpc/xprtrdma/svc_rdma_marshal.c b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
index 8d2edddf48cf..65b146297f5a 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_marshal.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
  */
 static u32 *decode_write_list(u32 *va, u32 *vaend)
 {
+        unsigned long start, end;
         int nchunks;
 
         struct rpcrdma_write_array *ary =
@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
                 return NULL;
         }
         nchunks = ntohl(ary->wc_nchunks);
-        if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
-            (unsigned long)vaend) {
+
+        start = (unsigned long)&ary->wc_array[0];
+        end = (unsigned long)vaend;
+        if (nchunks < 0 ||
+            nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
+            (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
                         ary, nchunks, vaend);
                 return NULL;
@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
 
 static u32 *decode_reply_array(u32 *va, u32 *vaend)
 {
+        unsigned long start, end;
         int nchunks;
         struct rpcrdma_write_array *ary =
                 (struct rpcrdma_write_array *)va;
@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
                 return NULL;
         }
         nchunks = ntohl(ary->wc_nchunks);
-        if (((unsigned long)&ary->wc_array[0] +
-             (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
-            (unsigned long)vaend) {
+
+        start = (unsigned long)&ary->wc_array[0];
+        end = (unsigned long)vaend;
+        if (nchunks < 0 ||
+            nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
+            (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
                 dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
                         ary, nchunks, vaend);
                 return NULL;