[PATCH v1 01/17] xdrgen: Reject out-of-range unsigned short values on decode

[Chuck Lever <cel@kernel.org>]

RFC 4506 does not define a 16-bit integer type. xdrgen's "unsigned
short" rather follows rpcgen, whose runtime decodes the type in
libtirpc's xdr_u_short() by reading one XDR_UNIT as a u_long and
assigning it to a u_short with a plain cast.

xdrgen_decode_unsigned_short() mirrors that cast, so an XDR_UNIT
carrying a value above U16_MAX decodes as its low sixteen bits. A
decoder's semantic checks on the narrowed value then cannot see the
high bits. NFS_ACLv2 is the first consumer: a SETACL entry whose
perm word is 0x00010007 decodes as perm 7, passes the check for bits
outside rwx, and installs read, write and execute.

Nothing in XDR or rpcgen requires a decoder to accept such a word.
Fail the decode when the wire word exceeds U16_MAX. The server-side
generated code reports the failure as GARBAGE_ARGS, which is the
right verdict for a malformed encoding of a 16-bit type, as opposed
to the ACL2ERR_INVAL that a well-formed but invalid value earns.

Signed-off-by: Chuck Lever <cel@kernel.org>
---
 include/linux/sunrpc/xdrgen/_builtins.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/linux/sunrpc/xdrgen/_builtins.h b/include/linux/sunrpc/xdrgen/_builtins.h
index c9033eb1c829..6b389181dc7b 100644
--- a/include/linux/sunrpc/xdrgen/_builtins.h
+++ b/include/linux/sunrpc/xdrgen/_builtins.h
@@ -88,10 +88,14 @@ static inline bool
 xdrgen_decode_unsigned_short(struct xdr_stream *xdr, u16 *ptr)
 {
 	__be32 *p = xdr_inline_decode(xdr, XDR_UNIT);
+	u32 val;
 
 	if (unlikely(!p))
 		return false;
-	*ptr = (u16)be32_to_cpup(p);
+	val = be32_to_cpup(p);
+	if (unlikely(val > U16_MAX))
+		return false;
+	*ptr = val;
 	return true;
 }
 
-- 
2.56.0