linux-kernel - Re: lz4: fix system halted at boot kernel x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150325004458.GA20767@suse.cz>
Date:	Wed, 25 Mar 2015 01:44:58 +0100
From:	David Sterba <dsterba@...e.cz>
To:	Krzysztof Kolasa <kkolasa@...soft.pl>
Cc:	tom.yeon@...driver.com, gregkh@...uxfoundation.org,
	linux-kernel@...r.kernel.org
Subject: Re: lz4: fix system halted at boot kernel x86_64 compressed lz4

On Tue, Mar 24, 2015 at 12:27:25PM +0100, Krzysztof Kolasa wrote:
> lz4: fix system halted at boot kernel x86_64 compressed lz4
> 
> Decompression process ends with an error when loading kernel:
> 
> Decoding failed
>  -- System halted

Serious regression detected ...

> 
> This condition is probably not needed ( from the last commit d5e7caf) :

The offending patch is on the way to stable trees, so it would be best
to postpone it for now.

> if( ... ||
>     (op + COPYLENGTH) > oend)
>     goto _output_error
> 
> macro LZ4_SECURE_COPY() tests op and does not copy any data
> when op exceeds the value, decompression process is continued.
> 
> added by analogy security for the ref:
> 
> if ((ref + COPYLENGTH) > oend...
> 
> to lz4_uncompress_unknownoutputsize(...)

I did only a quick check, your analysis seems correct. Reviewing the lz4
patches is tedious as the kernel implementations do not match the
upstream one line-by-line besides that I've missed the side effects of
the macro.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/