+ lib-validate-in-memory-lz4-chunk-length.patch added to mm-nonmm-unstable branch

+ lib-validate-in-memory-lz4-chunk-length.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: lib: validate in-memory LZ4 chunk length
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     lib-validate-in-memory-lz4-chunk-length.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/lib-validate-in-memory-lz4-chunk-length.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
Subject: lib: validate in-memory LZ4 chunk length
Date: Sat, 12 Sep 2026 21:32:17 +0800

We found and validated an issue in lib/decompress_unlz4.c.  The bug is
reachable by a root user through kexec_file_load() with a crafted external
initrd.

unlz4() reads the compressed chunk length from an in-memory initrd and
passes it to LZ4_decompress_safe().  It only checks the chunk length
against the allocation size when the input is filled by a callback.

Reject an in-memory chunk that extends past the remaining input before
calling the LZ4 decoder.  This prevents malformed initrds from making
the decoder read past the mapped archive.

Link: https://lore.kernel.org/59c6555c27aa7ba18ee227f9f02c78d15a37605f.1789219453.git.zhilinz@nebusec.ai
Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel")
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Kyungsik Lee <kyungsik.lee@lge.com>
Reported-by: VEGA <vega@nebusec.ai>
Assisted-by: LLM
---

 lib/decompress_unlz4.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/lib/decompress_unlz4.c~lib-validate-in-memory-lz4-chunk-length
+++ a/lib/decompress_unlz4.c
@@ -139,6 +139,10 @@ STATIC inline int INIT unlz4(u8 *input,
 		if (!fill) {
 			inp += 4;
 			size -= 4;
+			if (chunksize > size) {
+				error("data corrupted");
+				goto exit_2;
+			}
 		} else {
 			if (chunksize > LZ4_compressBound(uncomp_chunksize)) {
 				error("chunk length is longer than allocated");
_

Patches currently in -mm which might be from zhilinz@nebusec.ai are

lib-validate-in-memory-lz4-chunk-length.patch