From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 4 Jul 2014 21:45:57 +0000 (-0700)
Subject: 3.14-stable patches
X-Git-Tag: v3.4.97~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=86563a8ed872d395bb5167e9fde5c4cfa3698da1;p=thirdparty%2Fkernel%2Fstable-queue.git

3.14-stable patches

added patches:
	lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
---

diff --git a/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch b/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
new file mode 100644
index 00000000000..3bfc9a5ac4f
--- /dev/null
+++ b/queue-3.14/lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
@@ -0,0 +1,55 @@
+From 4a3a99045177369700c60d074c0e525e8093b0fc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 3 Jul 2014 16:06:57 -0700
+Subject: lz4: add overrun checks to lz4_uncompress_unknownoutputsize()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 4a3a99045177369700c60d074c0e525e8093b0fc upstream.
+
+Jan points out that I forgot to make the needed fixes to the
+lz4_uncompress_unknownoutputsize() function to mirror the changes done
+in lz4_decompress() with regards to potential pointer overflows.
+
+The only in-kernel user of this function is the zram code, which only
+takes data from a valid compressed buffer that it made itself, so it's
+not a big issue.  But due to external kernel modules using this
+function, it's better to be safe here.
+
+Reported-by: Jan Beulich <JBeulich@suse.com>
+Cc: "Don A. Bailey" <donb@securitymouse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/lz4/lz4_decompress.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -192,6 +192,8 @@ static int lz4_uncompress_unknownoutputs
+ 			int s = 255;
+ 			while ((ip < iend) && (s == 255)) {
+ 				s = *ip++;
++				if (unlikely(length > (size_t)(length + s)))
++					goto _output_error;
+ 				length += s;
+ 			}
+ 		}
+@@ -232,6 +234,8 @@ static int lz4_uncompress_unknownoutputs
+ 		if (length == ML_MASK) {
+ 			while (ip < iend) {
+ 				int s = *ip++;
++				if (unlikely(length > (size_t)(length + s)))
++					goto _output_error;
+ 				length += s;
+ 				if (s == 255)
+ 					continue;
+@@ -284,7 +288,7 @@ static int lz4_uncompress_unknownoutputs
+ 
+ 	/* write overflow error detected */
+ _output_error:
+-	return (int) (-(((char *) ip) - source));
++	return -1;
+ }
+ 
+ int lz4_decompress(const unsigned char *src, size_t *src_len,
diff --git a/queue-3.14/series b/queue-3.14/series
index 8b60be2c79c..9029c2ee941 100644
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -50,3 +50,4 @@ mips-kvm-remove-redundant-null-checks-before-kfree.patch
 mips-kvm-fix-memory-leak-on-vcpu.patch
 ipvs-fix-panic-due-to-non-linear-skb.patch
 ptrace-x86-force-iret-path-after-a-ptrace_stop.patch
+lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch