linux-kernel - Re: LZ4 decompressor broken on ARM due to missing strchrnul() string traverse in cpumask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 28 May 2019 13:53:46 +0200
From:   Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:     Rasmus Villemoes <linux@...musvillemoes.dk>
Cc:     Yury Norov <ynorov@...vell.com>,
        Andrew Morton <akpm@...ux-foundation.org>, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: LZ4 decompressor broken on ARM due to missing strchrnul() string
 traverse in cpumask_parse"

On 2019-05-28 13:33:12 [+0200], Rasmus Villemoes wrote:
> > How do we deal with this one?
> 
> Urgh. The problem is really in arch/arm/boot/compressed/decompress.c
> which does
> 
> #define _LINUX_STRING_H_
> 
> preventing linux/string.h from providing strchrnul. It also #includes
> asm/string.h, which for arm has a declaration of strchr(), explaining
> why this didn't use to fail.
> 
> However, the solution is also in the same file, it already has a section
> 
> /* Not needed, but used in some headers pulled in by decompressors */
> extern char * strstr(const char * s1, const char *s2);
> extern size_t strlen(const char *s);
> extern int memcmp(const void *cs, const void *ct, size_t count);
> 
> so just add another declaration to that list - I strongly assume we
> won't get a link failure since I find it hard to believe the
> decompressor would actually call cpumask_parse...

The hunk at the bottom of this mail compiles. Care to send to formal
patch?

> I'm wondering why this wasn't caught by 0day and/or while in -next?

must be related to lz4 usage in the configs tested :) A few set
XZ/LZO/LZMA. Majority falls back to GZIP.

> Rasmus

diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
index c16c1829a5e4f..05814c2b382a3 100644
--- a/arch/arm/boot/compressed/decompress.c
+++ b/arch/arm/boot/compressed/decompress.c
@@ -32,6 +32,7 @@
 extern char * strstr(const char * s1, const char *s2);
 extern size_t strlen(const char *s);
 extern int memcmp(const void *cs, const void *ct, size_t count);
+extern char * strchrnul(const char *,int);
 
 #ifdef CONFIG_KERNEL_GZIP
 #include "../../../../lib/decompress_inflate.c"

Sebastian