No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Guo Xuenan 73953dfa9d lz4: fix LZ4_decompress_safe_partial read out of bound
commit eafc0a02391b7b36617b36c97c4b5d6832cf5e24 upstream.

When partialDecoding, it is EOF if we've either filled the output buffer
or can't proceed with reading an offset for following match.

In some extreme corner cases when compressed data is suitably corrupted,
UAF will occur.  As reported by KASAN [1], LZ4_decompress_safe_partial
may lead to read out of bound problem during decoding.  lz4 upstream has
fixed it [2] and this issue has been disscussed here [3] before.

current decompression routine was ported from lz4 v1.8.3, bumping
lib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd
better fix it first.

[1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/
[2] c5d6f8a8be#
[3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/

Link: https://lkml.kernel.org/r/20211111105048.2006070-1-guoxuenan@huawei.com
Reported-by: syzbot+63d688f1d899c588fb71@syzkaller.appspotmail.com
Signed-off-by: Guo Xuenan <guoxuenan@huawei.com>
Reviewed-by: Nick Terrell <terrelln@fb.com>
Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Cc: Yann Collet <cyan@fb.com>
Cc: Chengyang Fan <cy.fan@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-15 14:18:39 +02:00
arch KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL 2022-04-15 14:18:36 +02:00
block Revert "Revert "block, bfq: honor already-setup queue merges"" 2022-04-15 14:18:23 +02:00
certs
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-15 14:18:04 +02:00
Documentation dt-bindings: spi: mxic: The interrupt property is not mandatory 2022-04-15 14:18:30 +02:00
drivers mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete 2022-04-15 14:18:39 +02:00
fs jfs: prevent NULL deref in diFree 2022-04-15 14:18:36 +02:00
include NFS: swap IO handling is slightly different for O_DIRECT IO 2022-04-15 14:18:35 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel dma-debug: fix return value of __setup handlers 2022-04-15 14:18:18 +02:00
lib lz4: fix LZ4_decompress_safe_partial read out of bound 2022-04-15 14:18:39 +02:00
LICENSES
mm mm: fix race between MADV_FREE reclaim and blkdev direct IO read 2022-04-15 14:18:36 +02:00
net SUNRPC: Handle low memory situations in call_status() 2022-04-15 14:18:38 +02:00
samples
scripts gcc-plugins/stackleak: Exactly match strings instead of prefixes 2022-04-15 14:18:22 +02:00
security Fix incorrect type in assignment of ipv6 port for audit 2022-04-15 14:18:22 +02:00
sound ASoC: topology: Allow TLV control to be either read or write 2022-04-15 14:18:30 +02:00
tools perf session: Remap buf if there is no space for event 2022-04-15 14:18:38 +02:00
usr
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.188 2022-03-28 08:46:49 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.