[PATCH] 9p: bound the xattr size used to allocate the ACL buffer

[Nguyen Ngoc Thang]

v9fs_fid_get_acl() sizes its kzalloc() buffer from the xattr length
reported by the 9p server. A server, or a syzbot-style fake one, can
report an arbitrarily large value. When it exceeds what the page
allocator can serve, mounting with posixacl,access=client trips:

  WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof
   ___kmalloc_large_node
   v9fs_fid_get_acl
   v9fs_get_acl
   v9fs_inode_from_fid_dotl
   v9fs_get_tree

A valid POSIX ACL always fits in an xattr value, so reject sizes above
XATTR_SIZE_MAX. __v9fs_get_acl() already maps this error to -EIO.

Reported-by: syzbot+de6fd6789748a8aa64a0@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=de6fd6789748a8aa64a0
Fixes: 85ff872d3f4a ("fs/9p: Implement POSIX ACL permission checking function")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
---
 fs/9p/acl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/9p/acl.c b/fs/9p/acl.c
index ae7e7cf7523a..0dd7e72bbdd3 100644
--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -29,6 +29,9 @@ static struct posix_acl *v9fs_fid_get_acl(struct p9_fid *fid, const char *name)
 		return ERR_PTR(size);
 	if (size == 0)
 		return ERR_PTR(-ENODATA);
+	/* the size is server-controlled; a valid ACL fits in an xattr */
+	if (size > XATTR_SIZE_MAX)
+		return ERR_PTR(-E2BIG);
 
 	value = kzalloc(size, GFP_NOFS);
 	if (!value)
-- 
2.43.0