lz4: fix system halted at boot kernel x86_64 compressed lz4

PATCH Superseded David Sterba 4 participants 16 messages Mar 25, 2015 – Apr 3, 2015 1 message not in the archive

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

David Sterba

author

2015-03-25 00:45 UTC #1 lore raw

Quoted 6 lines · Krzysztof Kolasa

lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted

Serious regression detected ...

Quoted 2 lines

This condition is probably not needed ( from the last commit d5e7caf) :

The offending patch is on the way to stable trees, so it would be best to postpone it for now.

Quoted 4 lines

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

Quoted 8 lines

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)

I did only a quick check, your analysis seems correct. Reviewing the lz4 patches is tedious as the kernel implementations do not match the upstream one line-by-line besides that I've missed the side effects of the macro.

Krzysztof Kolasa

2015-03-25 07:11 UTC #2 lore raw

Quoted 22 lines · David Sterba

Quoted 6 lines · Krzysztof Kolasa
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
Serious regression detected ...
Quoted 1 line
This condition is probably not needed ( from the last commit d5e7caf) :
The offending patch is on the way to stable trees, so it would be best to postpone it for now.
Quoted 9 lines
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:

Quoted 8 lines

Quoted 3 lines
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
I did only a quick check, your analysis seems correct. Reviewing the lz4 patches is tedious as the kernel implementations do not match the upstream one line-by-line besides that I've missed the side effects of the macro.

Add patch source for review (send to LKML) :
---------------------

lz4: fix system halted at boot kernel x86_64 compressed lz4

Decompression process ends with an error when loading kernel:

Decoding failed
-- System halted

This condition is probably not needed ( from the last commit d5e7caf) :

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy security for the ref:

if ((ref + COPYLENGTH) > oend...

to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

lib/lz4/lz4_decompress.c +3 -2

index f0f5c5c..e248c4e 100644
@@ -139,8 +139,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
-            if ((ref + COPYLENGTH) > oend ||
-                    (op + COPYLENGTH) > oend)
+            if ((ref + COPYLENGTH) > oend)
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,6 +269,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
+            if ((ref + COPYLENGTH) > oend)
+                goto _output_error;
 
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

-- 2.3.3.dirty

Greg KH

2015-03-31 15:22 UTC #3 lore raw

Quoted 76 lines · Krzysztof Kolasa

Quoted 22 lines · David Sterba
Quoted 6 lines · Krzysztof Kolasa
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
Serious regression detected ...
Quoted 1 line
This condition is probably not needed ( from the last commit d5e7caf) :
The offending patch is on the way to stable trees, so it would be best to postpone it for now.
Quoted 9 lines
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
Quoted 8 lines
Quoted 3 lines
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
I did only a quick check, your analysis seems correct. Reviewing the lz4 patches is tedious as the kernel implementations do not match the upstream one line-by-line besides that I've missed the side effects of the macro.
Add patch source for review (send to LKML) :
---------------------
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
This condition is probably not needed ( from the last commit d5e7caf) :
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
Signed-off-by Krzysztof Kolasa <[email protected]>
---
 lib/lz4/lz4_decompress.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
lib/lz4/lz4_decompress.c +1 -2
index f0f5c5c..e248c4e 100644
@@ -139,8 +139,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
-            if ((ref + COPYLENGTH) > oend ||
-                    (op + COPYLENGTH) > oend)
+            if ((ref + COPYLENGTH) > oend)
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

lib/lz4/lz4_decompress.c static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,

Quoted 9 lines

lib/lz4/lz4_decompress.c +2 -1

@@ -270,6 +269,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
+            if ((ref + COPYLENGTH) > oend)
+                goto _output_error;
 
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
-- 2.3.3.dirty

I'm confused, what is the problem here? What went wrong with the original patch that was posted, which is a mirror of what the lz4 code looks like "upstream"?

Why make this change? Does it need to go into 4.0-final, or should I just revert the original patch?

confused,

greg k-h

Krzysztof Kolasa

2015-04-03 11:34 UTC #4 lore raw

Quoted 83 lines · Greg KH

Quoted 82 lines · Krzysztof Kolasa
Quoted 22 lines · David Sterba
Quoted 6 lines · Krzysztof Kolasa
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
Serious regression detected ...
Quoted 1 line
This condition is probably not needed ( from the last commit d5e7caf) :
The offending patch is on the way to stable trees, so it would be best to postpone it for now.
Quoted 9 lines
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
Quoted 8 lines
Quoted 3 lines
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
I did only a quick check, your analysis seems correct. Reviewing the lz4 patches is tedious as the kernel implementations do not match the upstream one line-by-line besides that I've missed the side effects of the macro.
Add patch source for review (send to LKML) :
---------------------
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
This condition is probably not needed ( from the last commit d5e7caf) :
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
Signed-off-by Krzysztof Kolasa <[email protected]>
---
 lib/lz4/lz4_decompress.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
lib/lz4/lz4_decompress.c +3 -2
index f0f5c5c..e248c4e 100644
@@ -139,8 +139,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
-            if ((ref + COPYLENGTH) > oend ||
-                    (op + COPYLENGTH) > oend)
+            if ((ref + COPYLENGTH) > oend)
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
@@ -270,6 +269,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
+            if ((ref + COPYLENGTH) > oend)
+                goto _output_error;
 

Quoted 4 lines

lib/lz4/lz4_decompress.c static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
Quoted 3 lines
lib/lz4/lz4_decompress.c +0 -1
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
-- 2.3.3.dirty
I'm confused, what is the problem here? What went wrong with the

x86_64 lz4 kernel halted system...

Quoted 10 lines

original patch that was posted, which is a mirror of what the lz4 code looks like "upstream"?
Why make this change? Does it need to go into 4.0-final, or should I just revert the original patch?
confused,
greg k-h

OK, after further tests have modified the previous patch, please check and analyze:

[PATCH] lz4: fix system halted at boot kernel x86_64 compressed lz4

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed

-- System halted

This condition is not needed for 64bit kernel ( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +11 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

Signature · 1 line

2.4.0.rc0.dirty

Greg KH

2015-04-03 13:17 UTC #5 lore raw

Quoted 92 lines · Krzysztof Kolasa

Quoted 83 lines · Greg KH
Quoted 82 lines · Krzysztof Kolasa
Quoted 22 lines · David Sterba
Quoted 6 lines · Krzysztof Kolasa
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
Serious regression detected ...
Quoted 1 line
This condition is probably not needed ( from the last commit d5e7caf) :
The offending patch is on the way to stable trees, so it would be best to postpone it for now.
Quoted 9 lines
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
Quoted 8 lines
Quoted 3 lines
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
I did only a quick check, your analysis seems correct. Reviewing the lz4 patches is tedious as the kernel implementations do not match the upstream one line-by-line besides that I've missed the side effects of the macro.
Add patch source for review (send to LKML) :
---------------------
lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading kernel:
Decoding failed
-- System halted
This condition is probably not needed ( from the last commit d5e7caf) :
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.
added by analogy security for the ref:
if ((ref + COPYLENGTH) > oend...
to lz4_uncompress_unknownoutputsize(...)
Signed-off-by Krzysztof Kolasa <[email protected]>
---
 lib/lz4/lz4_decompress.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
lib/lz4/lz4_decompress.c +3 -2
index f0f5c5c..e248c4e 100644
@@ -139,8 +139,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
-            if ((ref + COPYLENGTH) > oend ||
-                    (op + COPYLENGTH) > oend)
+            if ((ref + COPYLENGTH) > oend)
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
@@ -270,6 +269,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
+            if ((ref + COPYLENGTH) > oend)
+                goto _output_error;
 
Quoted 4 lines
lib/lz4/lz4_decompress.c static int lz4_uncompress(const char *source, char *dest, int osize)
Quoted 3 lines
lib/lz4/lz4_decompress.c +0 -1
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
-- 2.3.3.dirty
I'm confused, what is the problem here? What went wrong with the
x86_64 lz4 kernel halted system...
Quoted 3 lines
original patch that was posted, which is a mirror of what the lz4 code looks like "upstream"?

Quoted 8 lines

Quoted 7 lines
Why make this change? Does it need to go into 4.0-final, or should I just revert the original patch?
confused,
greg k-h
OK, after further tests have modified the previous patch, please check and analyze:

What "previous patch"? None of my questions were answered here, so I have no idea what is going on at all.

I'm going to have to just revert the original patch as obviously something is wrong, but no one will tell me what, so I'll just go back to the old behavior...

thanks,

greg k-h

Krzysztof Kolasa

2015-04-03 13:58 UTC #6 lore raw

Quoted 1 line · Greg KH

What "previous patch"? None of my questions were answered here, so I have no idea what is going on at all. I'm going to have to just revert the original patch as obviously something is wrong, but no one will tell me what, so I'll just go back to the old behavior... thanks, greg k-h

again from the beginning:

commit:

https://github.com/torvalds/linux/commit/d5e7cafd69da24e6d6cc988fab6ea313a2577efc

halted my system on boot x86_64 kernel lz4 ( decompress error )

revert this commit is not required ( This patch improves security ), only slight changes I have proposed in my first patch, modified this patch today and I send again to LKML and CC to overview.

This is a simple change to the analysis

I do not believe that only I have a problem with the 64-bit kernel compressed in lz4.

Krzysztof

Alexander Kuleshov

2015-04-03 14:17 UTC #7 lore raw

Quoted 2 lines · Krzysztof Kolasa

I do not believe that only I have a problem with the 64-bit kernel compressed in lz4.

Hello all,

I can confirm that the same problem occurs for me. Tested current mainline kernel with the Krzysztof's patch on qemu and real hardware, it solves the problem.

Greg KH

2015-04-03 14:23 UTC #8 lore raw

Quoted 9 lines · Alexander Kuleshov

Quoted 2 lines · Krzysztof Kolasa
I do not believe that only I have a problem with the 64-bit kernel compressed in lz4.
Hello all,
I can confirm that the same problem occurs for me. Tested current mainline kernel with the Krzysztof's patch on qemu and real hardware, it solves the problem.

Ok, can someone send me the updated patch in a format that I can apply it in? Please add your tested-by line to the patch as well.

thanks,

greg k-h

Krzysztof Kolasa

2015-04-03 14:30 UTC #9 lore raw

Quoted 8 lines · Greg KH

Quoted 7 lines · Alexander Kuleshov
Quoted 1 line · Krzysztof Kolasa
I do not believe that only I have a problem with the 64-bit kernel compressed in lz4.
Hello all,
I can confirm that the same problem occurs for me. Tested current mainline kernel with the Krzysztof's patch on qemu and real hardware, it solves the problem.

Quoted 7 lines

Ok, can someone send me the updated patch in a format that I can apply it in? Please add your tested-by line to the patch as well.
thanks,
greg k-h

[PATCHv2] lz4: fix system halted at boot kernel x86_64 compressed lz4

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed

-- System halted

This condition is not needed for 64bit kernel ( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +11 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

-- 2.4.0.rc0.dirty

Greg KH

2015-04-03 14:44 UTC #10 lore raw

Quoted 14 lines · Krzysztof Kolasa

Quoted 13 lines · Greg KH
Quoted 7 lines · Alexander Kuleshov
Quoted 1 line · Krzysztof Kolasa
I do not believe that only I have a problem with the 64-bit kernel compressed in lz4.
Hello all,
I can confirm that the same problem occurs for me. Tested current mainline kernel with the Krzysztof's patch on qemu and real hardware, it solves the problem.
Ok, can someone send me the updated patch in a format that I can apply it in? Please add your tested-by line to the patch as well.
thanks,

Quoted 7 lines

Quoted 2 lines
greg k-h
[PATCHv2] lz4: fix system halted at boot kernel x86_64 compressed lz4
Decompression process ends with an error when loading 64bit lz4 kernel:

<snip>

I have to edit this by hand to remove the stuff above, please resend so that I can just pass the email to 'git am' directly. I deal with hundreds of patches a week, and can not waste time hand-editing them all...

thanks,

greg k-h

Krzysztof Kolasa

2015-04-03 15:12 UTC #11 lore raw

PATCH v2 1/1 lz4: fix system halted at boot kernel x86_64 compressed lz4

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed
-- System halted

This condition is not needed for 64bit kernel( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +11 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

Signature · 1 line

2.4.0.rc0.dirty

Greg KH

2015-04-03 17:36 UTC #12 lore raw

Quoted 44 lines · Krzysztof Kolasa

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed
-- System halted

This condition is not needed for 64bit kernel( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

Tested-by Alexander Kuleshov <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +4 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-

lib/lz4/lz4_decompress.c static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, · line 286

Quoted 10 lines

lib/lz4/lz4_decompress.c +7 -0

+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

All whitespace is messed up, and this patch can not be applied :(

Krzysztof Kolasa

2015-04-03 18:03 UTC #13 lore raw

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed
-- System halted

This condition is not needed for 64bit kernel( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +11 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

Signature · 1 line

2.4.0.rc0.dirty

Greg KH

2015-04-03 18:06 UTC #14 lore raw

Quoted 55 lines · Krzysztof Kolasa

Decompression process ends with an error when loading 64bit lz4 kernel:

Decoding failed
-- System halted

This condition is not needed for 64bit kernel( from the last commit d5e7caf )

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data when op exceeds the value, decompression process is continued.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by Krzysztof Kolasa <[email protected]>

---
 lib/lz4/lz4_decompress.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

lib/lz4/lz4_decompress.c +11 -1

index f0f5c5c..8a742b1 100644
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
             /* Error: request to write beyond destination buffer */
             if (cpy > oend)
                 goto _output_error;
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
             if ((ref + COPYLENGTH) > oend ||
                     (op + COPYLENGTH) > oend)
+#endif
                 goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)

@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
         if (cpy > oend - COPYLENGTH) {
             if (cpy > oend)
                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+            if ((ref + COPYLENGTH) > oend)
+#else
+            if ((ref + COPYLENGTH) > oend ||
+                    (op + COPYLENGTH) > oend)
+#endif
+                goto _output_error;
             LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
             while (op < cpy)
                 *op++ = *ref++;

Signature · 1 line

2.4.0.rc0.dirty

Still all tabs turned to spaces :(

Alexander Kuleshov

Tested-by

2015-04-03 18:18 UTC #15 lore raw

In reply to Greg KH

Quoted 5 lines · Greg KH

Quoted 4 lines · Krzysztof Kolasa
added by analogy to lz4_uncompress_unknownoutputsize(...)
Signed-off-by Krzysztof Kolasa <[email protected]>
Tested-by Alexander Kuleshov <[email protected]>

I'm not sure that my testing was important in this case, but if you'd to add my name, please use another email as:

Tested-by Alexander Kuleshov <[email protected]>

Greg KH

2015-04-03 19:01 UTC #16 lore raw

Quoted 11 lines · Alexander Kuleshov

Quoted 5 lines · Greg KH
Quoted 4 lines · Krzysztof Kolasa
added by analogy to lz4_uncompress_unknownoutputsize(...)
Signed-off-by Krzysztof Kolasa <[email protected]>
Tested-by Alexander Kuleshov <[email protected]>
I'm not sure that my testing was important in this case, but if you'd to add my name, please use another email as:
Tested-by Alexander Kuleshov <[email protected]>

Thanks, will do so. If I ever get a patch that can be applied :)