[PATCH] module/decompress: Use ssize_t for the zstd decompressed size

[PATCH] module/decompress: Use ssize_t for the zstd decompressed size

[Paul Menzel]

module_zstd_decompress() returns ssize_t, but keeps the decompressed
size in the int retval. Output of 2 GiB or more becomes a negative
value that is not an errno, and output of 4 GiB or more can also be
truncated to a positive size smaller than the pages mapped to
info->hdr. Declare retval as ssize_t like module_gzip_decompress() and
module_xz_decompress() do, and print it with %zd.

The Sashiko AI review found the same bug in the proposed LZ4 decoder,
which is modelled on the zstd decoder [1].

The x86_64 build boots in QEMU/KVM, and finit_module() with
MODULE_INIT_COMPRESSED_FILE and module.sig_enforce=1 decompresses the
237 .ko.zst modules without error.

Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression")
Link: https://sashiko.dev/#/patchset/20261113144233.193782-1-pmenzel@molgen.mpg.de?part=1 [1]
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
---

Notes:
    Claude Opus 5.5 (Claude Code) noticed that the zstd decoder has the
    bug Sashiko reported for the LZ4 patch, and wrote this patch and
    message. Tests: W=1 compile with GCC 16.2 for x86_64 (Debian config)
    and i386 (tinyconfig), both with MODULE_COMPRESS_ZSTD. Run time: the
    x86_64 build boots in QEMU/KVM, and finit_module() with
    MODULE_INIT_COMPRESSED_FILE and module.sig_enforce=1 decompresses the
    237 .ko.zst modules of a laptop's boot set without error; 223 load,
    14 fail in their init for lack of hardware, as with xz. The bug itself
    is not exercised; it needs a module that decompresses to 2 GiB or more.

 kernel/module/decompress.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c
index cce098671be97..ac4ff0e04f716 100644
--- a/kernel/module/decompress.c
+++ b/kernel/module/decompress.c
@@ -216,7 +216,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
 	ZSTD_DStream *dstream;
 	size_t ret;
 	size_t new_size = 0;
-	int retval;
+	ssize_t retval;
 
 	if (size < sizeof(signature) ||
 	    memcmp(buf, signature, sizeof(signature))) {
@@ -276,7 +276,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
 	} while (zstd_dec.pos == PAGE_SIZE && ret != 0);
 
 	if (retval) {
-		pr_err("ZSTD-decompression failed with status %d\n", retval);
+		pr_err("ZSTD-decompression failed with status %zd\n", retval);
 		retval = -EINVAL;
 		goto out;
 	}
-- 
2.54.0

Re: [PATCH] module/decompress: Use ssize_t for the zstd decompressed size

[Bradley Morgan]

On 15 November 2026 14:55:56 GMT, Paul Menzel <pmenzel@molgen.mpg.de>
wrote:
>module_zstd_decompress() returns ssize_t, but keeps the decompressed
>size in the int retval. Output of 2 GiB or more becomes a negative
>value that is not an errno, and output of 4 GiB or more can also be
>truncated to a positive size smaller than the pages mapped to
>info->hdr. Declare retval as ssize_t like module_gzip_decompress() and
>module_xz_decompress() do, and print it with %zd.
>
>The Sashiko AI review found the same bug in the proposed LZ4 decoder,
>which is modelled on the zstd decoder [1].
>
>The x86_64 build boots in QEMU/KVM, and finit_module() with
>MODULE_INIT_COMPRESSED_FILE and module.sig_enforce=1 decompresses the
>237 .ko.zst modules without error.
>
>Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression")
>Link: https://sashiko.dev/#/patchset/20261113144233.193782-1-pmenzel@molgen.mpg.de?part=1 [1]

Closes: and Reported-by: sashiko ?

Reviewed-by: Bradley Morgan <bradley.morgan@linux.dev>


>Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
>---
>
>Notes:
>    Claude Opus 5.5 (Claude Code) noticed that the zstd decoder has the
>    bug Sashiko reported for the LZ4 patch, and wrote this patch and
>    message. Tests: W=1 compile with GCC 16.2 for x86_64 (Debian config)
>    and i386 (tinyconfig), both with MODULE_COMPRESS_ZSTD. Run time: the
>    x86_64 build boots in QEMU/KVM, and finit_module() with
>    MODULE_INIT_COMPRESSED_FILE and module.sig_enforce=1 decompresses the
>    237 .ko.zst modules of a laptop's boot set without error; 223 load,
>    14 fail in their init for lack of hardware, as with xz. The bug itself
>    is not exercised; it needs a module that decompresses to 2 GiB or more.
>
> kernel/module/decompress.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c
>index cce098671be97..ac4ff0e04f716 100644
>--- a/kernel/module/decompress.c
>+++ b/kernel/module/decompress.c
>@@ -216,7 +216,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
> 	ZSTD_DStream *dstream;
> 	size_t ret;
> 	size_t new_size = 0;
>-	int retval;
>+	ssize_t retval;

Why signed? Ok then.

> 
> 	if (size < sizeof(signature) ||
> 	    memcmp(buf, signature, sizeof(signature))) {
>@@ -276,7 +276,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
> 	} while (zstd_dec.pos == PAGE_SIZE && ret != 0);
> 
> 	if (retval) {
>-		pr_err("ZSTD-decompression failed with status %d\n", retval);
>+		pr_err("ZSTD-decompression failed with status %zd\n", retval);
> 		retval = -EINVAL;
> 		goto out;
> 	}
>

--- Thanks!