linux-kernel - [PATCH] crypto: zstd - Fix compression bug caused by truncation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aNuQAr79Hdky3WII@gondor.apana.org.au>
Date: Tue, 30 Sep 2025 16:08:34 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Han Xu <han.xu@....com>
Cc: "suman.kumar.chakraborty@...el.com" <suman.kumar.chakraborty@...el.com>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"terrelln@...com" <terrelln@...com>,
	"dsterba@...e.com" <dsterba@...e.com>,
	Richard Weinberger <richard@....at>,
	"chengzhihao1@...wei.com" <chengzhihao1@...wei.com>,
	Miquel Raynal <miquel.raynal@...tlin.com>,
	"linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
	open list <linux-kernel@...r.kernel.org>,
	"open list:MEMORY TECHNOLOGY DEVICES (MTD)" <linux-mtd@...ts.infradead.org>,
	"imx@...ts.linux.dev" <imx@...ts.linux.dev>
Subject: [PATCH] crypto: zstd - Fix compression bug caused by truncation

On Mon, Sep 29, 2025 at 11:51:36PM +0000, Han Xu wrote:
> Hi Suman,
> 
> The patch f5ad93ffb5411 "crypto: zstd - convert to acomp"
> leads to the following kernel dump during UBIFS write back.

Thanks for the detailed report and instructions!

Please let me know if you still get the crash with this patch:

---8<---
Use size_t for the return value of zstd_compress_cctx as otherwise
negative errors will be truncated to a positive value.

Reported-by: Han Xu <han.xu@....com>
Fixes: f5ad93ffb541 ("crypto: zstd - convert to acomp")
Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>

diff --git a/crypto/zstd.c b/crypto/zstd.c
index c2a19cb0879d..ac318d333b68 100644
--- a/crypto/zstd.c
+++ b/crypto/zstd.c
@@ -83,7 +83,7 @@ static void zstd_exit(struct crypto_acomp *acomp_tfm)
 static int zstd_compress_one(struct acomp_req *req, struct zstd_ctx *ctx,
 			     const void *src, void *dst, unsigned int *dlen)
 {
-	unsigned int out_len;
+	size_t out_len;
 
 	ctx->cctx = zstd_init_cctx(ctx->wksp, ctx->wksp_size);
 	if (!ctx->cctx)
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt