flistxattr fails with ERANGE on a tmpfs file with an ACL, even though the buffer is large enough. The buffer must be considerably larger than what is needed, for flistxattr to succeed.

This causes xattr-related programs to fail when they use B = flistxattr(fd, NULL, 0) to get a buffer size B, and when flistxattr(fd, buffer, B) incorrectly fails the program fails. I ran into this problem with bleeding-edge coreutils, whose 'cp -a' incorrectly fails due to the flistxattr bug. I assume listxattr and llistxattr have similar problems.

I ran into the flistxattr bug recently with Fedora 42 with 'uname -rvm' reporting "6.14.8-300.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 22 19:26:02 UTC 2025 x86_64". I am not running any modules not shipped directly with Fedora. This is a regression, as there's no bug with RHEL 9.5 with uname -rvm reporting "5.14.0-503.21.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Dec 19 09:37:00 EST 2024 x86_64". Although I don't know exactly which kernel version introduced the bug it must be recent as I didn't see the bug in earlier Fedora 42 usage. My suspicion is that the bug is related to Stephen Smalley's recent kernel patch <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8b0ba61d>.

To reproduce the problem, use a tmpfs file system. Suppose it's /dev/shm. Run the following commands:

   touch /dev/shm/foo
   setfacl -m user:1:1 /dev/shm/foo
   gcc xattrbug.c # See end of bug report for source code.
   ./a.out </dev/shm/foo

./a.out should quietly exit with status 0. However, it outputs this:

  flistxattr (..., 17) failed with 17-byte xattr!: Numerical result out of range
  flistxattr (..., 41) returned 17, but smaller requests failed!

and then exits with status 1. strace reports the following two lines:

  flistxattr(0, "system.posix_acl_", 10000) = 17
  flistxattr(0, 0x403060, 17) = -1 ERANGE (Numerical result out of range)

and the second line is obviously wrong; flistxattr should succeed and return 17.

Here is the source code for xattrbug.c:

  #include <errno.h>
  #include <stdio.h>
  #include <sys/xattr.h>
  #include <unistd.h>

  char buf[10000];

  int
  main ()
  {
    ssize_t actual_size = flistxattr (STDIN_FILENO, buf, sizeof buf);
    if (actual_size < 0)
      return perror ("flistxattr with big buffer"), 1;

    for (ssize_t s = actual_size; s < sizeof buf; s++)
      {
	ssize_t t = flistxattr (STDIN_FILENO, buf, s);
	if (t < 0)
	  {
	    if (s == actual_size)
	      {
		int e = errno;
		fprintf (stderr,
			 ("flistxattr (..., %lld) failed with %lld-byte xattr"),
			 (long long int) s, (long long int) s);
		errno = e;
		perror ("!");
	      }
	  }
	else
	  {
	    if (s != t)
	      {
		printf (("flistxattr (..., %lld) returned %lld,"
			 " but smaller requests failed!\n"),
			(long long int) s, (long long int) t);
		return 1;
	      }
	    break;
	  }
      }
    return 0;
  }


Reproducible: Always