erofs-freebsd-out-tree/docs/pre11-batch-c.md

Pre11 Batch C: ACL Parsing Responsibilities

Scope

This batch mechanically separates POSIX ACL wire-format parsing from the FreeBSD vnode and xattr acquisition path.

Modified files:

• src/xattr.c
• docs/pre11-batch-c.md

No xattr body loading, header-only xattr behavior, namespace handling, public VOP interface, build configuration, or test infrastructure was changed.

Responsibility Split

erofs_get_acl() continues to own:

• mount option and ACL type validation;
• the default-ACL directory restriction;
• no-ACL filter handling and mode fallback;
• xattr namespace and name selection;
• both erofs_getxattr() stages;
• FreeBSD uio and iovec setup;
• ENOATTR fallback and the stack input buffer.

The new erofs_posix_acl_from_xattr() receives an already-read buffer and owns only wire-format validation and ACL population. It borrows both the input buffer and output ACL and performs no allocation, release, lookup, or vnode operation.

erofs_acl_from_mode() now receives the inode mode directly. This preserves the original fallback writes while preventing the parser from depending on an erofs_node.

Moved-Code Mapping

The parsing block formerly at the end of erofs_get_acl() was moved in the same statement order into erofs_posix_acl_from_xattr():

1. Header length and entry-size remainder validation.
2. Header copy and version validation.
3. Entry count calculation and maximum check.
4. Zero-entry mode fallback.
5. acl_cnt assignment and phase initialization.
6. Permission validation before tag-phase validation.
7. Tag phase transitions and UINT32_MAX rules.
8. Duplicate named user and group ID checks.
9. ACL entry writes and undefined-ID mapping.
10. The short-circuit phase != 6 || acl_posix1e_check(aclp) != 0 check.

No ACL zeroing or additional field initialization was added. Partial ACL mutation on malformed input remains possible exactly as before.

Branch Matrix

Input or state	Preserved result
POSIX ACL mount option disabled	EOPNOTSUPP in caller
Unsupported ACL type	EINVAL in caller
Default ACL requested for non-directory	EINVAL in caller
No-ACL filter match	Mode-derived ACL in caller
ACL xattr absent	Mode-derived ACL in caller
Xattr lookup/read failure	Original error from caller
Oversized xattr or nonzero UIO residual	EINTEGRITY in caller
Short or misaligned wire value	EINTEGRITY in parser
Unsupported wire version	EINTEGRITY in parser
Entry count above limit	EINTEGRITY in parser
Zero entries	Mode-derived ACL in parser
Invalid permission, phase, tag, or ID	EINTEGRITY in parser
Duplicate named user/group ID	EINTEGRITY in parser
Missing required mask or incomplete phase	EINTEGRITY in parser
Valid ACL	Identical ACL entry population and success

Resource And Error Audit

• The input buffer remains stack-owned by erofs_get_acl().
• The parser does not allocate, free, or retain pointers.
• There are no new cleanup paths.
• Xattr errors, UIO residual errors, wire errors, and ACL validation errors retain their previous ordering.
• erofs_xattr_load_body() and its release paths were not modified.
• The optional header validation helper was intentionally omitted to avoid touching the known header-only behavior.

Static Verification

The batch is validated with:

• a strict two-file path whitelist;
• unique definitions of erofs_get_acl(), erofs_acl_from_mode(), and erofs_posix_acl_from_xattr();
• pre/post comparison of parser returns, phase transitions, ACL writes, and duplicate-ID checks;
• git diff --check;
• confirmation that erofs_xattr_load_body() is absent from the source diff.

No build, QEMU smoke test, or feature test was run for this mechanical split.