[PATCH] NFSD: check for negative "len" values in nfssvc_decode_writeargs()

[Dan Carpenter <dan.carpenter@oracle.com>]

This code checks the upper bound of "len" but it needs to check for
negative values as well.

Fixes: a51b5b737a0b ("NFSD: Update the NFSv2 WRITE argument decoder to use struct xdr_stream")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
From static analysis and I am not sure of the implications of this bug.

 fs/nfsd/nfsxdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index aba8520b4b8b..a9f80e30320e 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -336,7 +336,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, struct xdr_stream *xdr)
 	/* opaque data */
 	if (xdr_stream_decode_u32(xdr, &args->len) < 0)
 		return false;
-	if (args->len > NFSSVC_MAXBLKSIZE_V2)
+	if (args->len < 0 || args->len > NFSSVC_MAXBLKSIZE_V2)
 		return false;
 	if (!xdr_stream_subsegment(xdr, &args->payload, args->len))
 		return false;
-- 
2.20.1