3.14-stable patches

added patches:
	lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch

diff --git a/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch b/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
new file mode 100644 (file)
index 0000000..3bfc9a5
--- /dev/null
+++ b/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
@@ -0,0 +1,55 @@
+From 4a3a99045177369700c60d074c0e525e8093b0fc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 3 Jul 2014 16:06:57 -0700
+Subject: lz4: add overrun checks to lz4_uncompress_unknownoutputsize()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 4a3a99045177369700c60d074c0e525e8093b0fc upstream.
+
+Jan points out that I forgot to make the needed fixes to the
+lz4_uncompress_unknownoutputsize() function to mirror the changes done
+in lz4_decompress() with regards to potential pointer overflows.
+
+The only in-kernel user of this function is the zram code, which only
+takes data from a valid compressed buffer that it made itself, so it's
+not a big issue.  But due to external kernel modules using this
+function, it's better to be safe here.
+
+Reported-by: Jan Beulich <JBeulich@suse.com>
+Cc: "Don A. Bailey" <donb@securitymouse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/lz4/lz4_decompress.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -192,6 +192,8 @@ static int lz4_uncompress_unknownoutputs
+                       int s = 255;
+                       while ((ip < iend) && (s == 255)) {
+                               s = *ip++;
++                              if (unlikely(length > (size_t)(length + s)))
++                                      goto _output_error;
+                               length += s;
+                       }
+               }
+@@ -232,6 +234,8 @@ static int lz4_uncompress_unknownoutputs
+               if (length == ML_MASK) {
+                       while (ip < iend) {
+                               int s = *ip++;
++                              if (unlikely(length > (size_t)(length + s)))
++                                      goto _output_error;
+                               length += s;
+                               if (s == 255)
+                                       continue;
+@@ -284,7 +288,7 @@ static int lz4_uncompress_unknownoutputs
+ 
+       /* write overflow error detected */
+ _output_error:
+-      return (int) (-(((char *) ip) - source));
++      return -1;
+ }
+ 
+ int lz4_decompress(const unsigned char *src, size_t *src_len,

diff --git a/queue-3.14/series b/queue-3.14/series
index 8b60be2c79c08ae46c9eca01df68cc5feb8f105d..9029c2ee94172757baf8bd3f4f4f761e7914c807 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -50,3 +50,4 @@ mips-kvm-remove-redundant-null-checks-before-kfree.patch
 mips-kvm-fix-memory-leak-on-vcpu.patch
 ipvs-fix-panic-due-to-non-linear-skb.patch
 ptrace-x86-force-iret-path-after-a-ptrace_stop.patch
+lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch