[PATCH v1 2/2] nfs_common: Do not stream-encode an ACL with fewer than three entries

[Chuck Lever <cel@kernel.org>]

nfs_stream_encode_acl() reports at least four wire entries for any
ACL that has entries, because a three-entry ACL is sent as four
with a synthesized ACL_MASK. The entry encoder then walks
a_entries[] up to that count. For an ACL with one or two entries,
which posix_acl_from_xattr() and the filesystem on-disk parsers do
not reject, the walk reads past the end of the posix_acl
allocation and copies the bytes into the GETACL reply.

Report zero wire entries for an ACL with fewer than three, the
same as for an ACL with none.

Fixes: 8edc0648880a ("NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 fs/nfs_common/nfsacl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 38bb2c294d7c..24ee7f622b18 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -157,7 +157,8 @@ bool nfs_stream_encode_acl(struct xdr_stream *xdr, struct inode *inode,
 			   int typeflag)
 {
 	const size_t elem_size = XDR_UNIT * 3;
-	u32 entries = (acl && acl->a_count) ? max_t(int, acl->a_count, 4) : 0;
+	u32 entries = (acl && acl->a_count >= 3) ?
+		      max_t(int, acl->a_count, 4) : 0;
 	struct nfsacl_encode_desc nfsacl_desc = {
 		.desc = {
 			.elem_size = elem_size,
-- 
2.55.0