fuse: limit xattr returned size

Don't let userspace filesystem give bogus values for the size of xattr and
xattr list.

Signed-off-by: Miklos Szeredi <[e-mail]>

fs/fuse/xattr.c

···
 	}
 	ret = fuse_simple_request(fc, &args);
 	if (!ret && !size)
-		ret = outarg.size;
+		ret = min_t(ssize_t, outarg.size, XATTR_SIZE_MAX);
 	if (ret == -ENOSYS) {
 		fc->no_getxattr = 1;
 		ret = -EOPNOTSUPP;
···
 	}
 	ret = fuse_simple_request(fc, &args);
 	if (!ret && !size)
-		ret = outarg.size;
+		ret = min_t(ssize_t, outarg.size, XATTR_LIST_MAX);
 	if (ret > 0 && size)
 		ret = fuse_verify_xattr_list(list, ret);
 	if (ret == -ENOSYS) {