nfs_read_reply() interprets the fields of an incoming packet directly
as a field length without checking the boundaries. Clamp the maximum
length to the packet length to avoid reading out of bounds.

Reported-by: Jai Verma <jai2.verma@outlook.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>