[PATCH] Fix unsigned underflow in xdr decoding.

With 'len' being unsigned now, we must make sure it never tries
to go negative...

Thanks: griffon26@kfk4ever.com (Maurice van der Pot)
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

fs/nfsd/nfs3xdr.c

@@ -347,8 +347,8 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 		svc_take_page(rqstp);
 		args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
 		args->vec[v].iov_len = len < PAGE_SIZE? len : PAGE_SIZE;
+		len -= args->vec[v].iov_len;
 		v++;
-		len -= PAGE_SIZE;
 	}
 	args->vlen = v;
 	return xdr_argsize_check(rqstp, p);

fs/nfsd/nfsxdr.c

@@ -255,8 +255,8 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 		svc_take_page(rqstp);
 		args->vec[v].iov_base = page_address(rqstp->rq_respages[pn]);
 		args->vec[v].iov_len = len < PAGE_SIZE?len:PAGE_SIZE;
+		len -= args->vec[v].iov_len;
 		v++;
-		len -= PAGE_SIZE;
 	}
 	args->vlen = v;
 	return xdr_argsize_check(rqstp, p);