Message-ID: <sashiko-outbox-201633@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH v2 01/15] lib/decompress_unlz4: use
 LZ4_decompress_safe_partial() before boot
Reply-To: sashiko-reviews@lists.linux.dev
To: "Michal Wilczynski" <m.wilczynski@samsung.com>, "Nathan Chancellor" <nathan@kernel.org>, "Nick
 Desaulniers" <ndesaulniers@google.com>, "Bill Wendling" <morbo@google.com>, "Justin
 Stitt" <justinstitt@google.com>, "Russell King" <linux@armlinux.org.uk>, "Thomas
 Bogendoerfer" <tsbogend@alpha.franken.de>, "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>, "Helge
 Deller" <deller@gmx.de>, "Heiko Carstens" <hca@linux.ibm.com>, "Vasily
 Gorbik" <gor@linux.ibm.com>, "Alexander Gordeev" <agordeev@linux.ibm.com>, "Christian
 Borntraeger" <borntraeger@linux.ibm.com>, "Sven Schnelle" <svens@linux.ibm.com>, "Thomas
 Gleixner" <tglx@kernel.org>, "Ingo Molnar" <mingo@redhat.com>, "Borislav
 Petkov" <bp@alien8.de>, "Dave Hansen" <dave.hansen@linux.intel.com>, x86@kernel.org, "H.
 Peter Anvin" <hpa@zytor.com>, "Minchan Kim" <minchan@kernel.org>, "Sergey
 Senozhatsky" <senozhatsky@chromium.org>, "Jens Axboe" <axboe@kernel.dk>, "Andrew
 Morton" <akpm@linux-foundation.org>
Cc: linux-s390@vger.kernel.org, "Yann Collet" <yann.collet.73@gmail.com>, "Nick
 Terrell" <terrelln@meta.com>, "Gao Xiang" <xiang@kernel.org>, "Chao Yu" <chao@kernel.org>, "Jaegeuk
 Kim" <jaegeuk@kernel.org>, "Eric Biggers" <ebiggers@kernel.org>, "Herbert
 Xu" <herbert@gondor.apana.org.au>, "David Laight" <david.laight.linux@gmail.com>, Sungguk <sungguk.na@samsung.com>, "Jaehoon
 Chung" <jh80.chung@samsung.com>, "Marek Szyprowski" <m.szyprowski@samsung.com>, linux-crypto@vger.kernel.org
In-Reply-To: <20261106-lz4-vendor-upstream-v2-1-ee04c3f0d7dc@samsung.com>
References: <20261106-lz4-vendor-upstream-v2-0-ee04c3f0d7dc@samsung.com>
 <CGME20261106144249eucas1p1ca5f03b764c6305120da3e8b65f76ed1@eucas1p1.samsung.com>
 <20261106-lz4-vendor-upstream-v2-1-ee04c3f0d7dc@samsung.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Fri, 06 Nov 2026 14:59:23 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found 3 potential
issues to consider:
- [Medium] lib/decompress_unlz4: unvalidated chunksize passed to decoder
  in unlz4()
- [Low] lib/decompress_unlz4: partial decode skips full-block checks in
  unlz4()
- [Low] lib/decompress_unlz4: unlz4() does not check out_len =3D=3D 0 at
  stream end
--

commit 8a11d492456e8edabb6dad4a7ecb828134c99572
Author: Michal Wilczynski <m.wilczynski@samsung.com>

lib/decompress_unlz4: use LZ4_decompress_safe_partial() before boot

This commit replaces LZ4_decompress_fast() with
LZ4_decompress_safe_partial() in the pre-boot unlz4() path and checks that
each chunk produces the expected output size.

> diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
> index c0dbb3cea915e..dc20c22e08790 100644
> --- a/lib/decompress_unlz4.c
> +++ b/lib/decompress_unlz4.c
> @@ -151,14 +151,17 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
>  			}
>  		}
>  #ifdef PREBOOT
> -		if (out_len >=3D uncomp_chunksize) {
> +		if (out_len >=3D uncomp_chunksize)
>  			dest_len =3D uncomp_chunksize;
> -			out_len -=3D dest_len;
> -		} else
> +		else
>  			dest_len =3D out_len;
> +		out_len -=3D dest_len;
> =20
> -		ret =3D LZ4_decompress_fast(inp, outp, dest_len);
> -		chunksize =3D ret;
> +		ret =3D LZ4_decompress_safe_partial(inp, outp, chunksize,
> +						  dest_len, dest_len);

[Severity: Medium]
Can a truncated or corrupted chunk header cause LZ4_decompress_safe_partial=
()
to read past the end of the input buffer?

Previously, LZ4_decompress_fast() ignored chunksize and overwrote it with t=
he
consumed byte count before the !fill path checked size -=3D chunksize at the
bottom of the loop:

lib/decompress_unlz4.c:unlz4() {
	...
		if (!fill) {
			inp +=3D 4;
			size -=3D 4;
		} else {
	...
		if (!fill) {
			size -=3D chunksize;

			if (size =3D=3D 0)
				break;
			else if (size < 0) {
				error("data corrupted");
				goto exit_2;
			}
			inp +=3D chunksize;
		}
}

Passing chunksize from get_unaligned_le32(inp) directly to
LZ4_decompress_safe_partial() before checking it against size lets the
decoder read past input + in_len when chunksize > size, or pass a negative
compressedSize when chunksize >=3D 0x80000000.

> +		/* A chunk once the image's stated size is reached is corrupt. */
> +		if (!dest_len || ret !=3D (int)dest_len)
> +			ret =3D -1;

[Severity: Low]
Should this call LZ4_decompress_safe(inp, outp, chunksize, dest_len) instead
of LZ4_decompress_safe_partial()?

In LZ4_decompress_generic(), partial_decode mode clamps literal runs and
matches that would exceed dest_len and stops as soon as dest_len bytes are
written without verifying that all chunksize input bytes were consumed.  A
corrupted chunk that expands beyond dest_len or leaves trailing bytes inside
chunksize will still return dest_len and pass this check.

[Severity: Low]
Can a truncated image that ends on a chunk boundary still return success wh=
en
out_len has not reached zero?

This check rejects chunks that decode short or arrive after out_len reaches
zero, but if the input stream ends early between chunks (or has chunksize =
=3D=3D
0), the loop jumps to exit_3 and returns 0 with out_len > 0.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261106-lz4-vendor=
-upstream-v2-0-ee04c3f0d7dc@samsung.com?part=3D1