[merged mm-nonmm-stable] lib-validate-in-memory-lz4-chunk-length.patch removed from -mm tree

[merged mm-nonmm-stable] lib-validate-in-memory-lz4-chunk-length.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: lib: validate in-memory LZ4 chunk length
has been removed from the -mm tree.  Its filename was
     lib-validate-in-memory-lz4-chunk-length.patch

This patch was dropped because it was merged into the mm-nonmm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
Subject: lib: validate in-memory LZ4 chunk length
Date: Sat, 12 Sep 2026 21:32:17 +0800

We found and validated an issue in lib/decompress_unlz4.c.  The bug is
reachable by a root user through kexec_file_load() with a crafted external
initrd.

unlz4() reads the compressed chunk length from an in-memory initrd and
passes it to LZ4_decompress_safe().  It only checks the chunk length
against the allocation size when the input is filled by a callback.

Reject an in-memory chunk that extends past the remaining input before
calling the LZ4 decoder.  This prevents malformed initrds from making
the decoder read past the mapped archive.

Link: https://lore.kernel.org/59c6555c27aa7ba18ee227f9f02c78d15a37605f.1789219453.git.zhilinz@nebusec.ai
Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel")
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: VEGA <vega@nebusec.ai>
Assisted-by: LLM
Cc: Kyungsik Lee <kyungsik.lee@lge.com>
---

 lib/decompress_unlz4.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/lib/decompress_unlz4.c~lib-validate-in-memory-lz4-chunk-length
+++ a/lib/decompress_unlz4.c
@@ -139,6 +139,10 @@ STATIC inline int INIT unlz4(u8 *input,
 		if (!fill) {
 			inp += 4;
 			size -= 4;
+			if (chunksize > size) {
+				error("data corrupted");
+				goto exit_2;
+			}
 		} else {
 			if (chunksize > LZ4_compressBound(uncomp_chunksize)) {
 				error("chunk length is longer than allocated");
_

Patches currently in -mm which might be from zhilinz@nebusec.ai are