Fix DFLTCC not writing header bits when avail_out == 0

diff --git a/arch/s390/dfltcc_deflate.c b/arch/s390/dfltcc_deflate.c
index 4692789f8f6cc454387a51a7a881f18a927e3207..4db18fe40421c73a72fac3e7cd370a17532ed34c 100644 (file)
--- a/arch/s390/dfltcc_deflate.c
+++ b/arch/s390/dfltcc_deflate.c
@@ -162,13 +162,18 @@ again:
             send_eobs(strm, param);
             param->bcf = 0;
             dfltcc_state->block_threshold = strm->total_in + dfltcc_state->block_size;
-            if (strm->avail_out == 0) {
-                *result = need_more;
-                return 1;
-            }
         }
     }
 
+    /* No space for compressed data. If we proceed, dfltcc_cmpr() will return
+     * DFLTCC_CC_OP1_TOO_SHORT without buffering header bits, but we will still
+     * set BCF=1, which is wrong. Avoid complications and return early.
+     */
+    if (strm->avail_out == 0) {
+        *result = need_more;
+        return 1;
+    }
+
     /* The caller gave us too much data. Pass only one block worth of
      * uncompressed data to DFLTCC and mask the rest, so that on the next
      * iteration we start a new block.