Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-07 Thread Jarkko Sakkinen
On Thu Mar 7, 2024 at 10:01 PM EET, Jarkko Sakkinen wrote: > On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote: > > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > > EVM, IMA, and fscaps

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-07 Thread Jarkko Sakkinen
On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-05 Thread Christian Brauner
On Tue, 05 Mar 2024 13:27:06 +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-05 Thread Serge E. Hallyn
On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-05 Thread Seth Forshee
On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-05 Thread Christoph Hellwig
Looks good: Reviewed-by: Christoph Hellwig

[PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

2024-03-05 Thread Christian Brauner
The vfs_getxattr_alloc() interface is a special-purpose in-kernel api that does a racy query-size+allocate-buffer+retrieve-data. It is used by EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues where 9p returned values that amount to allocating about 8000GB worth of memory (cf.