| Message ID | 1428569873-28946-1-git-send-email-luis.henriques@canonical.com |
|---|---|
| State | New |
| Headers | show |
On Thu, Apr 09, 2015 at 09:57:53AM +0100, Luis Henriques wrote: > This is a note to let you know that I have just added a patch titled > > LZ4 : fix the data abort issue Please note that this patch can cause a boot to hang on one of 32bit or 64bit environments (I don't remember). This is fixed in "lz4: fix system halted at boot kernel x86_64 compressed lz4" that's yet on the way to stable trees.
On Thu, Apr 09, 2015 at 03:25:30PM +0200, David Sterba wrote: > On Thu, Apr 09, 2015 at 09:57:53AM +0100, Luis Henriques wrote: > > This is a note to let you know that I have just added a patch titled > > > > LZ4 : fix the data abort issue > > Please note that this patch can cause a boot to hang on one of 32bit or > 64bit environments (I don't remember). This is fixed in > > "lz4: fix system halted at boot kernel x86_64 compressed lz4" > > that's yet on the way to stable trees. Really? I don't think that patch is even on its way to Linus's tree yet :(
Hi David, On Thu, Apr 09, 2015 at 03:25:30PM +0200, David Sterba wrote: > On Thu, Apr 09, 2015 at 09:57:53AM +0100, Luis Henriques wrote: > > This is a note to let you know that I have just added a patch titled > > > > LZ4 : fix the data abort issue > > Please note that this patch can cause a boot to hang on one of 32bit or > 64bit environments (I don't remember). This is fixed in > > "lz4: fix system halted at boot kernel x86_64 compressed lz4" > > that's yet on the way to stable trees. Thank you for the heads-up. I'll hold this patch and wait for a fix to be available (although it looks like it may still take a while :-) Cheers, -- Luís
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c index 7a85967060a5..f0f5c5c3de12 100644 --- a/lib/lz4/lz4_decompress.c +++ b/lib/lz4/lz4_decompress.c @@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) /* Error: request to write beyond destination buffer */ if (cpy > oend) goto _output_error; + if ((ref + COPYLENGTH) > oend || + (op + COPYLENGTH) > oend) + goto _output_error; LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); while (op < cpy) *op++ = *ref++;
This is a note to let you know that I have just added a patch titled LZ4 : fix the data abort issue to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue This patch is scheduled to be released in version 3.16.7-ckt10. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.16.y-ckt tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Luis ------ From ccdfeb1c31e4dc193743320640cb31dbf0a5f5f0 Mon Sep 17 00:00:00 2001 From: JeHyeon Yeon <tom.yeon@windriver.com> Date: Mon, 16 Mar 2015 01:03:19 +0000 Subject: LZ4 : fix the data abort issue commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc upstream. If the part of the compression data are corrupted, or the compression data is totally fake, the memory access over the limit is possible. This is the log from my system usning lz4 decompression. [6502]data abort, halting [6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000 [6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000 [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc [6528]spsr 0x400001f3 and the memory addresses of some variables at the moment are ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory over @oend. Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> --- lib/lz4/lz4_decompress.c | 3 +++ 1 file changed, 3 insertions(+)