Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Guo Xuenan 73953dfa9d lz4: fix LZ4_decompress_safe_partial read out of bound ... commit eafc0a02391b7b36617b36c97c4b5d6832cf5e24 upstream. When partialDecoding, it is EOF if we've either filled the output buffer or can't proceed with reading an offset for following match. In some extreme corner cases when compressed data is suitably corrupted, UAF will occur. As reported by KASAN [1], LZ4_decompress_safe_partial may lead to read out of bound problem during decoding. lz4 upstream has fixed it [2] and this issue has been disscussed here [3] before. current decompression routine was ported from lz4 v1.8.3, bumping lib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd better fix it first. [1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/ [2] c5d6f8a8be# [3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/ Link: https://lkml.kernel.org/r/20211111105048.2006070-1-guoxuenan@huawei.com Reported-by: syzbot+63d688f1d899c588fb71@syzkaller.appspotmail.com Signed-off-by: Guo Xuenan <guoxuenan@huawei.com> Reviewed-by: Nick Terrell <terrelln@fb.com> Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com> Cc: Yann Collet <cyan@fb.com> Cc: Chengyang Fan <cy.fan@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-15 14:18:39 +02:00
..
842
crypto	crypto: sha256 - Remove sha256/224_init code duplication	2019-09-05 14:54:54 +10:00
dim	lib/dim: Fix -Wunused-const-variable warnings	2019-07-25 11:34:39 -07:00
fonts	Fonts: Replace discarded const qualifier	2020-11-10 12:37:26 +01:00
livepatch
lz4	lz4: fix LZ4_decompress_safe_partial read out of bound	2022-04-15 14:18:39 +02:00
lzo	lib/lzo: fix ambiguous encoding bug in lzo-rle	2020-06-17 16:40:28 +02:00
math
mpi	lib/mpi: use kcalloc in mpi_resize	2021-09-15 09:47:29 +02:00
raid6	lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3	2022-04-15 14:18:23 +02:00
reed_solomon
vdso	lib/vdso: Make clock_getres() POSIX compliant again	2019-10-23 14:48:23 +02:00
xz	lib/xz: Validate the value before assigning it to an enum variable	2021-11-17 09:48:31 +01:00
zlib_deflate
zlib_inflate	lib/zlib: remove outdated and incorrect pre-increment optimization	2020-06-24 17:50:39 +02:00
zstd	lib/zstd/mem.h: replace __inline by inline	2019-09-15 19:42:16 +02:00
.gitignore
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c
assoc_array.c
atomic64.c
atomic64_test.c
audit.c
bcd.c
bch.c
bitmap.c	cpumask: Implement cpumask_or_equal()	2019-07-25 15:47:37 +02:00
bitrev.c
bsearch.c
btree.c
bucket_locks.c
bug.c	bug: Remove redundant condition check in report_bug	2021-05-14 09:44:27 +02:00
build_OID_registry
bust_spinlocks.c
chacha.c
check_signature.c
checksum.c
clz_ctz.c
clz_tab.c
cmdline.c
cmpdi2.c
compat_audit.c
cpu_rmap.c
cpumask.c
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c	crc-t10dif: Fix potential crypto notify dead-lock	2020-08-19 08:15:54 +02:00
crc4.c
crc7.c
crc8.c
crc16.c
crc32.c	lib/crc32.c: fix trivial typo in preprocessor condition	2020-10-29 09:57:52 +01:00
crc32defs.h
crc32test.c	lib/crc32test: remove extra local_irq_disable/enable	2020-11-10 12:37:27 +01:00
crc64.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c	debugobjects: Fix various data races	2020-02-24 08:36:52 +01:00
dec_and_lock.c
decompress.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c	lib/decompress_unlz4.c: correctly handle zero-padding around initrds.	2021-07-20 16:10:46 +02:00
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression	2021-11-17 09:48:31 +01:00
devres.c	devres: keep both device name and resource name in pretty name	2020-08-21 13:05:32 +02:00
digsig.c
dump_stack.c	dump_stack: avoid the livelock of the dump_lock	2019-11-06 08:47:50 -08:00
dynamic_debug.c	dyndbg: fix a BUG_ON in ddebug_describe_flags	2020-08-19 08:16:04 +02:00
dynamic_queue_limits.c
earlycpio.c
error-inject.c
errseq.c
extable.c	lib/extable.c: add missing prototypes	2019-09-25 17:51:39 -07:00
fault-inject.c
fdt.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c	uapi: rename ext2_swab() to swab() and share globally in swab.h	2020-04-13 10:48:07 +02:00
find_bit_benchmark.c
flex_proportions.c
gen_crc32table.c
gen_crc64table.c
genalloc.c	lib/genalloc: fix the overflow when size is too big	2021-01-12 20:16:10 +01:00
generic-radix-tree.c	lib/generic-radix-tree.c: add kmemleak annotations	2019-10-14 15:04:00 -07:00
glob.c
globtest.c
hexdump.c	lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds	2019-09-25 17:51:39 -07:00
hweight.c
idr.c	ida: Free allocated bitmap in error path	2020-10-29 09:57:47 +01:00
inflate.c
interval_tree.c
interval_tree_test.c
iomap.c
iomap_copy.c
iommu-helper.c
ioremap.c	mm/ioremap: probe platform for p4d huge map support	2019-07-16 19:23:22 -07:00
iov_iter.c	lib/iov_iter: initialize "flags" in new pipe_buffer	2022-02-23 11:59:59 +01:00
irq_poll.c
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig	ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE	2022-03-19 13:40:16 +01:00
Kconfig.debug	Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH	2021-09-26 14:07:10 +02:00
Kconfig.kasan	kasan: add memory corruption identification for software tag-based mode	2019-09-24 15:54:07 -07:00
Kconfig.kgdb
Kconfig.ubsan
kfifo.c	Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"	2019-08-30 18:47:15 -07:00
klist.c
kobject.c	kobject: Restore old behaviour of kobject_del(NULL)	2020-09-17 13:47:52 +02:00
kobject_uevent.c	kobject_uevent: remove warning in init_uevent_argv()	2021-05-19 10:08:33 +02:00
kstrtox.c	lib: vsprintf: Fix handling of number field widths in vsscanf	2021-07-14 16:53:16 +02:00
kstrtox.h	lib: vsprintf: Fix handling of number field widths in vsscanf	2021-07-14 16:53:16 +02:00
libcrc32c.c
list_debug.c
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c
logic_pio.c	PCI: Fix pci_register_io_range() memory leak	2021-03-17 17:03:44 +01:00
lru_cache.c
lshrdi3.c
Makefile	avoid __memcat_p link failure	2021-05-07 10:51:37 +02:00
memcat_p.c
memory-notifier-error-inject.c
memweight.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c	net: fix nla_strcmp to handle more then one trailing null character	2021-05-19 10:08:27 +02:00
nmi_backtrace.c
nodemask.c
notifier-error-inject.c
notifier-error-inject.h
objagg.c
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c	once: Fix panic when module unload	2021-09-03 10:08:12 +02:00
packing.c
parman.c
parser.c
pci_iomap.c
percpu-refcount.c
percpu_counter.c
percpu_test.c
plist.c
pm-notifier-error-inject.c
radix-tree.c	idr: Fix idr_alloc_u32 on 32-bit systems	2019-11-03 06:36:50 -05:00
random32.c	random32: make prandom_u32() output unpredictable	2020-11-18 19:20:20 +01:00
ratelimit.c
rbtree.c	lib/rbtree: avoid generating code twice for the cached versions	2019-07-16 19:23:22 -07:00
rbtree_test.c	augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro	2019-09-25 17:51:39 -07:00
refcount.c
rhashtable.c
sbitmap.c	sbitmap: only queue kyber's wait callback if not already active	2020-01-12 12:21:44 +01:00
scatterlist.c	sgl_alloc_order: fix memory leak	2020-11-05 11:43:22 +01:00
seq_buf.c	seq_buf: Fix overflow in seq_buf_putmem_hex()	2021-07-19 08:53:16 +02:00
sg_pool.c
sg_split.c	lib: scatterlist: Fix to support no mapped sg	2019-08-08 07:45:01 -06:00
sha1.c
show_mem.c	mm: remove quicklist page table caches	2019-09-24 15:54:09 -07:00
siphash.c	siphash: use _unaligned version by default	2021-12-08 09:01:12 +01:00
smp_processor_id.c
sort.c	media: lib/sort.c: implement sort() variant taking context argument	2019-08-19 13:14:53 -03:00
stackdepot.c	lib: stackdepot: turn depot_lock spinlock to raw_spinlock	2021-05-22 11:38:30 +02:00
stmp_device.c
string.c	lib/string.c: implement stpcpy	2020-10-01 13:18:23 +02:00
string_helpers.c	lib/string_helpers: fix some kerneldoc warnings	2019-07-16 19:23:22 -07:00
strncpy_from_user.c	lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()	2020-01-29 16:45:29 +01:00
strnlen_user.c	lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()	2020-01-29 16:45:29 +01:00
syscall.c	lib/syscall: fix syscall registers retrieval on 32-bit platforms	2020-12-11 13:23:32 +01:00
test-kstrtox.c
test-string_helpers.c
test_bitfield.c
test_bitmap.c
test_blackhole_dev.c
test_bpf.c	bpf/tests: Do not PASS tests without actually testing the result	2021-09-22 12:26:29 +02:00
test_debug_virtual.c
test_firmware.c	test_firmware: add support for request_firmware_into_buf	2019-09-04 13:31:28 +02:00
test_hash.c
test_hexdump.c
test_ida.c
test_kasan.c	kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE	2020-06-22 09:31:12 +02:00
test_kmod.c	lib/test: use after free in register_test_dev_kmod()	2022-04-15 14:18:21 +02:00
test_list_sort.c
test_memcat_p.c
test_meminit.c	lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test	2022-01-27 09:19:55 +01:00
test_module.c
test_objagg.c	test_objagg: Fix potential memory leak in error handling	2020-06-30 15:37:04 -04:00
test_overflow.c	lib/test_overflow.c: avoid tainting the kernel and fix wrap size	2019-07-16 19:23:22 -07:00
test_parman.c
test_printf.c	vsprintf: don't obfuscate NULL and error pointers	2020-05-27 17:46:43 +02:00
test_rhashtable.c
test_siphash.c
test_sort.c
test_stackinit.c	lib/test_stackinit: Fix static initializer test	2021-09-22 12:26:38 +02:00
test_static_key_base.c
test_static_keys.c
test_string.c	lib/test_string.c: add some testcases for strchr and strnchr	2019-07-16 19:23:22 -07:00
test_strscpy.c
test_sysctl.c
test_ubsan.c
test_user_copy.c	usercopy: Avoid soft lockups in test_check_nonzero_user()	2019-10-16 14:56:21 +02:00
test_uuid.c
test_vmalloc.c
test_xarray.c	XArray: Fix xas_create_range() when multi-order entry present	2022-04-15 14:18:28 +02:00
textsearch.c	lib: textsearch: fix escapes in example code	2019-10-03 12:12:23 -04:00
timerqueue.c	lib/timerqueue: Rely on rbtree semantics for next timer	2019-07-24 17:38:01 +02:00
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c	lib/ubsan: don't serialize UBSAN report	2020-01-09 10:20:07 +01:00
ubsan.h
ucmpdi2.c
ucs2_string.c
usercopy.c	lib: introduce copy_struct_from_user() helper	2019-10-01 15:45:03 +02:00
uuid.c
vsprintf.c	lib: vsprintf: Fix handling of number field widths in vsscanf	2021-07-14 16:53:16 +02:00
win_minmax.c
xarray.c	XArray: Update the LRU list in xas_split()	2022-04-15 14:18:28 +02:00
xxhash.c