From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063961; b=AL/GNrr5o1G972/YTJ3BI5L2kKKr4BGr3sFxroiCXH0WYgzbT1O/UAedWeTrJyV+TNoa WKD+mB5ldxvk0+Act0Zt6CH3BOvekdP0+PwikTmqvCMADUbjFtEHbM92/HNNUIyfAWIh0 1zBBjo2v52p86eADsxAH6EBgks4vSsmlx1/4SMIQjWfQRxCkdPTaNlu3MkpMZoSHw+vDn YP6dY28K7fwnbd/6Tz6haz4ShwIPOfbdN7r8qrwEHjIDASm3Kr0FyTtSboWhH0Hj3AHda BdDUyJA8aD/rh6Jxe3SnI+Yy/5k7IKS+szw0Rsbrj7y3AfNZY1SUx8j/snPoC+1L5gQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063961; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=eZO+bCkyA0gEn8QUXODpx7jWa6MVbVMFbamEBA0HYUY=; b=wLRjduPjae+3jhaA3UtsmsUBoEb8rgGDzSfGcHku0RIFeEenSfP0vHQBoKY7Y9AZIy+T LpqeamzjhVfpHFEx5A6hWQ7KlsKlezzndCouJtImk6l4468hBFE6qERyj3UYJkOmcbcrx Apa4YgNT75+GTrvX5StBBXfrwB5ZisFsMwfoSdCTXKZlxuPLrSqW5wFqTVu37SWQQPdac o3Rt90yCzS5yZuGb9p/YtRMSlatBLZKFO2Wg1kovjfXMTVoUbxHERSBiFjKCbx0Kh+qiy VmUb9ryMY3Iy/G7HryYuPMIAmKmtqcCWP9Z60r0evLTVRT3jJY9QwLosG1k1DpTps5A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=dP1K6IGE; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7A4C6083614; Sat, 7 Nov 2026 15:06:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=dP1K6IGE Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F04A1F008A1; Sat, 7 Nov 2026 15:06:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063960; bh=eZO+bCkyA0gEn8QUXODpx7jWa6MVbVMFbamEBA0HYUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dP1K6IGEu1lHtHOXQ4Hc3eow0ov4i4pzcOGjye2JSt3+4C2hTkNOIk8YqsPgRzQ+n GdTLBlWtTGRvS2kLROSnJ46rXV5fRPOKXdf3qVb54fdZgxBIbzOrlQcRzauFY4pJKY 5Sk3pobzBw6n2j6zter08SIFUSJb1NHLMtGiCBKA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Karl Mehltretter , Herbert Xu , Sasha Levin Subject: [PATCH 7.3 0148/1257] lib/842: reject output overflows from index and short data Date: Sat, 7 Nov 2026 08:40:44 -0500 Message-ID: <20261107134943.401946855@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Karl Mehltretter [ Upstream commit 38ed7182f3491ec1449ff246551e11ad82adba45 ] The output length passed to sw842_decompress() is the caller's buffer capacity. Indexed copies write 2, 4 or 8 bytes and short-data templates write up to 7, but neither checks that capacity before writing and decrementing p->olen. Overwriting an undersized destination then underflows p->olen, which is unsigned, so every later bounds check in the stream passes. Subsequent operations keep writing past the destination, and a matching CRC lets sw842_decompress() return success with an output length larger than the capacity the caller supplied. This is reachable through zram's compressed writeback path. With 842 selected, targeted corruption of the compressed data on its backing device made a KASAN kernel report vmalloc-out-of-bounds writes in __do_index() and sw842_decompress() when zram read the page back. Check the remaining output before both operations and return -ENOSPC, matching the other output-producing templates. Fixes: 2da572c959dd ("lib: add software 842 compression/decompression") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- lib/842/842_decompress.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c index 582085ef8b49c..87d1e0f8a4926 100644 --- a/lib/842/842_decompress.c +++ b/lib/842/842_decompress.c @@ -165,6 +165,9 @@ static int __do_index(struct sw842_param *p, u8 size, u8 bits, u64 fsize) u64 index, offset, total = round_down(p->out - p->ostart, 8); int ret; + if (size > p->olen) + return -ENOSPC; + ret = next_bits(p, &index, bits); if (ret) return ret; @@ -344,6 +347,8 @@ int sw842_decompress(const u8 *in, unsigned int ilen, if (!bytes || bytes > SHORT_DATA_BITS_MAX) return -EINVAL; + if (bytes > p.olen) + return -ENOSPC; while (bytes-- > 0) { ret = next_bits(&p, &tmp, 8); -- 2.53.0