Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

lz4: fix system halt at boot kernel on x86_64

Sometimes, on x86_64, decompression fails with the following
error:

Decompressing Linux...

Decoding failed

-- System halted

This condition is not needed for a 64bit kernel(from commit d5e7caf):

if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error

macro LZ4_SECURE_COPY() tests op and does not copy any data
when op exceeds the value.

added by analogy to lz4_uncompress_unknownoutputsize(...)

Signed-off-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Tested-by: Alexander Kuleshov <kuleshovmail@gmail.com>
Tested-by: Caleb Jorden <cjorden@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Krzysztof Kolasa and committed by
Greg Kroah-Hartman
99b7e93c 61a590fa

+11 -1
+11 -1
lib/lz4/lz4_decompress.c
··· 140 140 /* Error: request to write beyond destination buffer */ 141 141 if (cpy > oend) 142 142 goto _output_error; 143 + #if LZ4_ARCH64 144 + if ((ref + COPYLENGTH) > oend) 145 + #else 143 146 if ((ref + COPYLENGTH) > oend || 144 147 (op + COPYLENGTH) > oend) 148 + #endif 145 149 goto _output_error; 146 150 LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); 147 151 while (op < cpy) ··· 270 266 if (cpy > oend - COPYLENGTH) { 271 267 if (cpy > oend) 272 268 goto _output_error; /* write outside of buf */ 273 - 269 + #if LZ4_ARCH64 270 + if ((ref + COPYLENGTH) > oend) 271 + #else 272 + if ((ref + COPYLENGTH) > oend || 273 + (op + COPYLENGTH) > oend) 274 + #endif 275 + goto _output_error; 274 276 LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); 275 277 while (op < cpy) 276 278 *op++ = *ref++;