]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
LZ4 : fix the data abort issue
authorJeHyeon Yeon <tom.yeon@windriver.com>
Mon, 16 Mar 2015 01:03:19 +0000 (01:03 +0000)
committerSasha Levin <sasha.levin@oracle.com>
Sat, 28 Mar 2015 13:33:25 +0000 (09:33 -0400)
commit9bda2fc64c145fe4afa2ffcfdc2f78df5fcbfbdd
treed0360dbcab2e251b0897db0ed2fe44b4d2d51029
parent7809f283e07340fa5b3dc01e2f23207c8521598e
LZ4 : fix the data abort issue

[ Upstream commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc ]

If the part of the compression data are corrupted, or the compression
data is totally fake, the memory access over the limit is possible.

This is the log from my system usning lz4 decompression.
   [6502]data abort, halting
   [6503]r0  0x00000000 r1  0x00000000 r2  0xdcea0ffc r3  0xdcea0ffc
   [6509]r4  0xb9ab0bfd r5  0xdcea0ffc r6  0xdcea0ff8 r7  0xdce80000
   [6515]r8  0x00000000 r9  0x00000000 r10 0x00000000 r11 0xb9a98000
   [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc  0x820149bc
   [6528]spsr 0x400001f3
and the memory addresses of some variables at the moment are
    ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000

As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
over @oend.

Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
lib/lz4/lz4_decompress.c