diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-08-29 11:18:50 +0200 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-09-11 15:03:04 +1000 |
| commit | deb631649882bbf43f7c2fc79b5990139fd744ba (patch) | |
| tree | 7577de282594147c74cc44c33cf4e41bbf81c1a2 | |
| parent | 38ed7182f3491ec1449ff246551e11ad82adba45 (diff) | |
| download | linux-next-deb631649882bbf43f7c2fc79b5990139fd744ba.tar.gz linux-next-deb631649882bbf43f7c2fc79b5990139fd744ba.zip | |
lib/842: require a complete history block for repeat templates
An 842 repeat template copies the preceding eight-byte output block. The
decoder rejects a repeat only when no output has been produced. A
short-data operation can produce between one and seven bytes before a
repeat.
Such a stream makes the repeat copy read before the start of the output
buffer. Depending on the surrounding mapping, this can fault or bring
preceding memory into the decompressed data.
This is also reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
to a short-data-then-repeat stream made a KASAN kernel report a
vmalloc-out-of-bounds read when zram read the page back.
Require at least one complete output block before accepting a repeat.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | lib/842/842_decompress.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c index 87d1e0f8a492..45a9815abd63 100644 --- a/lib/842/842_decompress.c +++ b/lib/842/842_decompress.c @@ -309,7 +309,7 @@ int sw842_decompress(const u8 *in, unsigned int ilen, if (ret) return ret; - if (p.out == out) /* no previous bytes */ + if (p.out - p.ostart < 8) /* no complete previous block */ return -EINVAL; /* copy rep + 1 */ |