mirror_ubuntu-kernels/lib
Guo Xuenan eafc0a0239 lz4: fix LZ4_decompress_safe_partial read out of bound
When partialDecoding, it is EOF if we've either filled the output buffer
or can't proceed with reading an offset for following match.

In some extreme corner cases when compressed data is suitably corrupted,
UAF will occur.  As reported by KASAN [1], LZ4_decompress_safe_partial
may lead to read out of bound problem during decoding.  lz4 upstream has
fixed it [2] and this issue has been disscussed here [3] before.

current decompression routine was ported from lz4 v1.8.3, bumping
lib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd
better fix it first.

[1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/
[2] c5d6f8a8be#
[3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/

Link: https://lkml.kernel.org/r/20211111105048.2006070-1-guoxuenan@huawei.com
Reported-by: syzbot+63d688f1d899c588fb71@syzkaller.appspotmail.com
Signed-off-by: Guo Xuenan <guoxuenan@huawei.com>
Reviewed-by: Nick Terrell <terrelln@fb.com>
Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Cc: Yann Collet <cyan@fb.com>
Cc: Chengyang Fan <cy.fan@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-04-08 14:20:36 -10:00
..
842
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2022-03-21 16:02:36 -07:00
dim
fonts
kunit linux-kselftest-kunit-5.18-rc1 2022-03-23 12:56:39 -07:00
livepatch
lz4 lz4: fix LZ4_decompress_safe_partial read out of bound 2022-04-08 14:20:36 -10:00
lzo
math
mpi lib/mpi: export mpi_rshift 2022-03-03 10:47:52 +12:00
pldmfw
raid6 lib/raid6: Include <asm/ppc-opcode.h> for VPERMXOR 2022-03-08 15:20:21 -08:00
reed_solomon
test_fortify fortify: Detect struct member overflows in memset() at compile-time 2022-02-13 16:50:06 -08:00
vdso
xz lib/xz, lib/decompress_unxz.c: Fix spelling in comments 2021-10-19 23:44:30 +08:00
zlib_deflate
zlib_dfltcc
zlib_inflate
zstd lib: zstd: Don't add -O3 to cflags 2021-11-18 13:16:22 -08:00
.gitignore fortify: Add compile-time FORTIFY_SOURCE tests 2021-10-18 12:28:52 -07:00
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c
asn1_encoder.c lib: remove redundant assignment to variable ret 2022-01-20 08:52:55 +02:00
assoc_array.c
atomic64_test.c
atomic64.c locking/atomic: atomic64: Remove unusable atomic ops 2021-12-13 10:56:09 +01:00
audit.c
bcd.c
bch.c
bitfield_kunit.c
bitmap.c lib: bitmap: fix many kernel-doc warnings 2022-03-23 19:00:33 -07:00
bitrev.c
bootconfig.c Merge branch 'akpm' (patches from Andrew) 2021-11-06 14:08:17 -07:00
bsearch.c
btree.c
bucket_locks.c
bug.c
build_OID_registry
buildid.c
bust_spinlocks.c
check_signature.c
checksum.c
clz_ctz.c
clz_tab.c
cmdline_kunit.c
cmdline.c
cmpdi2.c
compat_audit.c
cpu_rmap.c
cpumask.c memblock: use memblock_free for freeing virtual pointers 2021-11-06 13:30:41 -07:00
crc4.c
crc7.c
crc8.c
crc16.c
crc32.c lib/crc32: Make crc32_be weak for arch override 2022-01-31 11:21:43 +11:00
crc32defs.h
crc32test.c lib/crc32test: correct printed bytes count 2022-01-31 11:21:43 +11:00
crc64-rocksoft.c crypto: add rocksoft 64b crc guard tag framework 2022-03-07 12:48:35 -07:00
crc64.c lib: add rocksoft model crc64 2022-03-07 12:48:35 -07:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c
dec_and_lock.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c lib/xz, lib/decompress_unxz.c: Fix spelling in comments 2021-10-19 23:44:30 +08:00
decompress_unzstd.c lib: zstd: Add decompress_sources.h for decompress_unzstd 2021-11-08 16:55:26 -08:00
decompress.c
devmem_is_allowed.c
devres.c
digsig.c
dump_stack.c
dynamic_debug.c dyndbg: refine verbosity 1-4 summary-detail 2021-10-21 13:01:25 +02:00
dynamic_queue_limits.c
earlycpio.c
errname.c
error-inject.c
errseq.c
extable.c
fault-inject-usercopy.c
fault-inject.c
fdt_addresses.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit_benchmark.c lib: add find_first_and_bit() 2022-01-15 08:47:31 -08:00
find_bit.c lib: add find_first_and_bit() 2022-01-15 08:47:31 -08:00
flex_proportions.c flex_proportions: Allow N events instead of 1 2021-10-18 07:49:39 -04:00
gen_crc32table.c
gen_crc64table.c lib: add rocksoft model crc64 2022-03-07 12:48:35 -07:00
genalloc.c all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate 2022-01-15 08:47:31 -08:00
generic-radix-tree.c
glob.c
globtest.c
hexdump.c
hweight.c
idr.c
inflate.c
interval_tree_test.c
interval_tree.c
iomap_copy.c
iomap.c
iommu-helper.c
iov_iter.c lib/iov_iter: initialize "flags" in new pipe_buffer 2022-02-21 10:16:39 -05:00
irq_poll.c
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig crypto: add rocksoft 64b crc guard tag framework 2022-03-07 12:48:35 -07:00
Kconfig.debug cxl for 5.18 2022-03-24 18:07:03 -07:00
Kconfig.kasan kasan: allow enabling KASAN_VMALLOC and SW/HW_TAGS 2022-03-24 19:06:48 -07:00
Kconfig.kcsan Revert "ubsan, kcsan: Don't combine sanitizer with kcov on clang" 2022-03-23 19:00:35 -07:00
Kconfig.kfence kfence: allow use of a deferrable timer 2022-03-22 15:57:11 -07:00
Kconfig.kgdb
Kconfig.ubsan Revert "ubsan, kcsan: Don't combine sanitizer with kcov on clang" 2022-03-23 19:00:35 -07:00
kfifo.c
klist.c
kobject_uevent.c kobject: remove kset from struct kset_uevent_ops callbacks 2021-12-28 11:26:18 +01:00
kobject.c driver core: make kobj_type constant. 2021-12-27 10:40:00 +01:00
kstrtox.c kstrtox: uninline everything 2022-01-20 08:52:53 +02:00
kstrtox.h
libcrc32c.c
linear_ranges.c
list_debug.c lib/list_debug.c: print more list debugging context in __list_del_entry_valid() 2022-01-20 08:52:53 +02:00
list_sort.c
list-test.c list: test: Add a test for list_entry_is_head() 2022-02-25 08:39:01 -07:00
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c lockdep/selftests: Adapt ww-tests for PREEMPT_RT 2021-12-04 10:56:24 +01:00
lockref.c
logic_iomem.c lib/logic_iomem: correct fallback config references 2022-03-11 10:42:56 +01:00
logic_pio.c
lru_cache.c
lshrdi3.c
Makefile memcpy updates for v5.18-rc1 2022-03-26 12:19:04 -07:00
memcat_p.c
memcpy_kunit.c string.h: Introduce memset_startat() for wiping trailing members and padding 2021-10-18 12:28:52 -07:00
memory-notifier-error-inject.c
memregion.c
memweight.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c
nmi_backtrace.c printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces 2021-11-10 16:12:00 +01:00
nodemask.c
notifier-error-inject.c
notifier-error-inject.h
objagg.c lib: objagg: Use the bitmap API when applicable 2021-12-24 14:54:29 -08:00
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c
overflow_kunit.c lib: overflow: Convert to Kunit 2022-02-27 09:29:02 -08:00
packing.c
parman.c
parser.c
pci_iomap.c
percpu_counter.c
percpu_test.c
percpu-refcount.c
plist.c
pm-notifier-error-inject.c
radix-tree.c
random32.c random: replace custom notifier chain with standard one 2022-03-12 18:00:56 -07:00
ratelimit.c
rbtree_test.c
rbtree.c
ref_tracker.c ref_tracker: remove filter_irq_stacks() call 2022-02-06 11:05:28 +00:00
refcount.c
rhashtable.c
sbitmap.c lib/sbitmap: allocate sb->map via kvzalloc_node 2022-03-21 20:01:34 -06:00
scatterlist.c mm/scatterlist: replace the !preemptible warning in sg_miter_stop() 2021-11-09 10:02:50 -08:00
seq_buf.c
sg_pool.c
sg_split.c
sha1.c lib/crypto: sha1: re-roll loops to reduce code size 2022-01-18 13:03:55 +01:00
show_mem.c
siphash.c siphash: use _unaligned version by default 2021-11-29 19:50:50 -08:00
slub_kunit.c
smp_processor_id.c
sort.c lib/sort: Add priv pointer to swap function 2022-03-17 20:17:18 -07:00
stackdepot.c lib/stackdepot: always do filter_irq_stacks() in stack_depot_save() 2022-01-22 08:33:38 +02:00
stackinit_kunit.c lib: stackinit: Convert to KUnit 2022-03-21 08:13:04 -07:00
stmp_device.c
string_helpers.c fortify: Detect struct member overflows in memcpy() at compile-time 2022-02-13 16:50:06 -08:00
string.c
strncpy_from_user.c uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
strnlen_user.c uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
syscall.c
test_bitmap.c lib: bitmap: add performance test for bitmap_print_to_pagebuf 2022-01-15 08:47:31 -08:00
test_bitops.c
test_bits.c
test_blackhole_dev.c
test_bpf.c bpf: Change value of MAX_TAIL_CALL_CNT from 32 to 33 2021-11-16 14:03:15 +01:00
test_debug_virtual.c
test_firmware.c
test_fprobe.c fprobe: Add a selftest for fprobe 2022-03-17 20:17:14 -07:00
test_fpu.c
test_free_pages.c
test_hash.c test_hash.c: refactor into kunit 2022-01-20 08:52:54 +02:00
test_hexdump.c
test_hmm_uapi.h
test_hmm.c mm: remove the extra ZONE_DEVICE struct page refcount 2022-03-03 12:47:33 -05:00
test_ida.c
test_kasan_module.c kasan: test: bypass __alloc_size checks 2021-11-06 13:30:33 -07:00
test_kasan.c kasan: update function name in comments 2022-03-24 19:06:48 -07:00
test_kmod.c lib/test: use after free in register_test_dev_kmod() 2022-03-29 15:13:36 -07:00
test_kprobes.c test_kprobes: Move it from kernel/ to lib/ 2021-10-26 17:23:46 -04:00
test_linear_ranges.c
test_list_sort.c
test_lockup.c lib/test_lockup: fix kernel pointer check for separate address spaces 2022-02-25 09:36:06 +01:00
test_memcat_p.c
test_meminit.c lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test 2022-01-20 08:52:54 +02:00
test_min_heap.c
test_module.c
test_objagg.c
test_parman.c
test_printf.c vsprintf: Make %pGp print the hex value 2021-10-27 13:40:14 +02:00
test_ref_tracker.c lib: add tests for reference tracker 2021-12-06 16:04:44 -08:00
test_rhashtable.c
test_scanf.c
test_siphash.c
test_sort.c
test_static_key_base.c
test_static_keys.c
test_string.c
test_strscpy.c
test_sysctl.c test_sysctl: simplify subdirectory registration with register_sysctl() 2022-01-22 08:33:35 +02:00
test_ubsan.c ubsan: remove CONFIG_UBSAN_OBJECT_SIZE 2022-01-20 08:52:55 +02:00
test_user_copy.c
test_uuid.c
test_vmalloc.c lib/test_vmalloc.c: use swap() to make code cleaner 2021-11-06 13:30:37 -07:00
test_xarray.c XArray: Fix xas_create_range() when multi-order entry present 2022-03-28 19:25:11 -04:00
test-kstrtox.c
test-string_helpers.c
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c ubsan: no need to unset panic_on_warn in ubsan_epilogue() 2022-03-23 19:00:35 -07:00
ubsan.h
ucmpdi2.c
ucs2_string.c
usercopy.c
uuid.c
vsprintf.c lib/vsprintf: avoid redundant work with 0 size 2022-03-24 19:06:44 -07:00
win_minmax.c
xarray.c XArray update for 5.18: 2022-04-01 13:40:44 -07:00
xxhash.c