linux-kernel - Re: [PATCH 1/1] s390/decompressor: specify _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y9ffKxhKv8Gan34Z@osiris>
Date:   Mon, 30 Jan 2023 16:15:55 +0100
From:   Heiko Carstens <hca@...ux.ibm.com>
To:     Vasily Gorbik <gor@...ux.ibm.com>
Cc:     Alexander Egorenkov <egorenar@...ux.ibm.com>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Nick Terrell <terrelln@...com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-mips@...r.kernel.org
Subject: Re: [PATCH 1/1] s390/decompressor: specify __decompress() buf len to
 avoid overflow

On Sun, Jan 29, 2023 at 11:47:23PM +0100, Vasily Gorbik wrote:
> Historically calls to __decompress() didn't specify "out_len" parameter
> on many architectures including s390, expecting that no writes beyond
> uncompressed kernel image are performed. This has changed since commit
> 2aa14b1ab2c4 ("zstd: import usptream v1.5.2") which includes zstd library
> commit 6a7ede3dfccb ("Reduce size of dctx by reutilizing dst buffer
> (#2751)"). Now zstd decompression code might store literal buffer in
> the unwritten portion of the destination buffer. Since "out_len" is
> not set, it is considered to be unlimited and hence free to use for
> optimization needs. On s390 this might corrupt initrd or ipl report
> which are often placed right after the decompressor buffer. Luckily the
> size of uncompressed kernel image is already known to the decompressor,
> so to avoid the problem simply specify it in the "out_len" parameter.
> 
> Link: https://github.com/facebook/zstd/commit/6a7ede3dfccb
> Signed-off-by: Vasily Gorbik <gor@...ux.ibm.com>
> ---
>  arch/s390/boot/decompressor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied, thanks!