nfsd: Fix handling of RPC messages too large to cache

The NFSv4.1/4.2 session negotiates a limit to the size
of an RPC reply message that can be cached for the session
slot.

This patch fixes the code so that it checks that limit and
does not cache replies larger than the limit, even if the
client requested that it be cached.

This patch is slightly different than what the author
submitted, but retains the check for reply cache size limit.

Reviewed by:	rmacklem
MFC after:	1 month

sys/fs/nfsserver/nfs_nfsdserv.c

@@ -4835,7 +4835,13 @@ nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
 			printf("Consider increasing kern.ipc.maxsockbuf\n");
 		do_printf = false;
 	}
+	if (sep->sess_maxresp <= NFS_MAXXDR) {
+		nd->nd_repstat = NFSERR_TOOSMALL;
+		goto nfsmout;
+	}
 	sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
+	if (sep->sess_maxrespcached > sep->sess_maxresp)
+		sep->sess_maxrespcached = sep->sess_maxresp;
 	sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
 	sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
 	if (sep->sess_maxslots > NFSV4_SLOTS)

sys/fs/nfsserver/nfs_nfsdstate.c

@@ -6222,6 +6222,10 @@ nfsrv_cache_session(struct nfsrv_descript *nd, struct mbuf **m)
 		m_freem(*m);
 		return;
 	}
+	if (*m != NULL && m_length(*m, NULL) > sep->sess_maxrespcached) {
+		m_freem(*m);
+		*m = NULL;
+	}
 	nfsv4_seqsess_cacherep(nd->nd_slotid, sep->sess_slots, nd->nd_repstat,
 	    m);
 	NFSUNLOCKSESSION(shp);