TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
60297da088c09cc8c4763f0ba376ebe43f993aa6
kernel_xiaomi_sm8250/lib
History
Guo Xuenan 60297da088 lz4: fix LZ4_decompress_safe_partial read out of bound 
commit eafc0a02391b7b36617b36c97c4b5d6832cf5e24 upstream.

When partialDecoding, it is EOF if we've either filled the output buffer
or can't proceed with reading an offset for following match.

In some extreme corner cases when compressed data is suitably corrupted,
UAF will occur.  As reported by KASAN [1], LZ4_decompress_safe_partial
may lead to read out of bound problem during decoding.  lz4 upstream has
fixed it [2] and this issue has been disscussed here [3] before.

current decompression routine was ported from lz4 v1.8.3, bumping
lib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd
better fix it first.

[1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/
[2] c5d6f8a8be#
[3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/

Link: https://lkml.kernel.org/r/20211111105048.2006070-1-guoxuenan@huawei.com
Reported-by: syzbot+63d688f1d899c588fb71@syzkaller.appspotmail.com
Change-Id: I24b1fe4aaed8b89b65f66d753b72a2f9f32ac79b
Signed-off-by: Guo Xuenan <guoxuenan@huawei.com>
Reviewed-by: Nick Terrell <terrelln@fb.com>
Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Cc: Yann Collet <cyan@fb.com>
Cc: Chengyang Fan <cy.fan@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-05 19:21:55 +03:00
..
842
…
crypto
UPSTREAM: crypto: lib - remove unneeded selection of XOR_BLOCKS
2024-01-23 14:13:19 +00:00
fonts
Fonts: Replace discarded const qualifier
2020-11-10 12:35:57 +01:00
lz4
lz4: fix LZ4_decompress_safe_partial read out of bound
2024-06-05 19:21:55 +03:00
lzo
…
mpi
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
2023-09-23 10:48:15 +02:00
raid6
lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
2022-04-15 14:14:54 +02:00
reed_solomon
rslib: Fix handling of of caller provided syndrome
2019-07-26 09:14:12 +02:00
vdso
ANDROID: lib/vdso: do not update timespec if clock_getres() fails
2020-06-30 05:51:06 +00:00
xz
lib/xz: Validate the value before assigning it to an enum variable
2021-11-26 11:36:06 +01:00
zlib_deflate
…
zlib_inflate
lib/zlib: remove outdated and incorrect pre-increment optimization
2020-06-25 15:33:02 +02:00
zstd
…
.gitignore
…
argv_split.c
…
ashldi3.c
…
ashrdi3.c
…
asn1_decoder.c
…
assoc_array.c
assoc_array: Fix BUG_ON during garbage collect
2022-06-06 08:24:20 +02:00
atomic64_test.c
…
atomic64.c
…
audit.c
…
bcd.c
…
bch.c
lib/bch: fix possible stack overrun
2018-10-12 09:17:46 +02:00
bitmap.c
lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf
2019-12-01 09:17:08 +01:00
bitrev.c
…
bsearch.c
kprobes: Prohibit probing on bsearch()
2019-04-05 22:33:08 +02:00
btree.c
…
bucket_locks.c
…
bug.c
bug: Remove redundant condition check in report_bug
2021-05-22 10:59:35 +02:00
build_OID_registry
…
bust_spinlocks.c
…
check_signature.c
…
checksum.c
…
clz_ctz.c
lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
2023-08-30 16:31:55 +02:00
clz_tab.c
…
cmdline.c
…
cmpdi2.c
…
compat_audit.c
…
cordic.c
…
cpu_rmap.c
lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
2023-06-14 10:57:13 +02:00
cpumask.c
…
crc4.c
…
crc7.c
…
crc8.c
…
crc16.c
…
crc32.c
lib/crc32.c: fix trivial typo in preprocessor condition
2020-10-30 10:38:21 +01:00
crc32defs.h
…
crc32test.c
lib/crc32test: remove extra local_irq_disable/enable
2020-11-10 12:35:57 +01:00
crc64.c
…
crc-ccitt.c
…
crc-itu-t.c
…
crc-t10dif.c
…
ctype.c
…
debug_info.c
…
debug_locks.c
locking/lockdep: Fix debug_locks off performance problem
2018-11-13 11:08:20 -08:00
debugobjects.c
debugobjects: Recheck debug_objects_enabled before reporting
2023-08-11 11:45:24 +02:00
dec_and_lock.c
…
decompress_bunzip2.c
…
decompress_inflate.c
…
decompress_unlz4.c
lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
2021-07-20 16:16:10 +02:00
decompress_unlzma.c
…
decompress_unlzo.c
…
decompress_unxz.c
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
2021-11-26 11:36:06 +01:00
decompress.c
…
devres.c
lib: devres: add a helper function for ioremap_uc
2020-05-10 10:30:11 +02:00
digsig.c
…
div64.c
lib/div64.c: off by one in shift
2019-04-20 09:16:05 +02:00
dump_stack.c
dump_stack: avoid the livelock of the dump_lock
2019-11-12 19:20:37 +01:00
dynamic_debug.c
Merge 4.19.285 into android-4.19-stable
2023-06-14 09:45:37 +00:00
dynamic_queue_limits.c
…
earlycpio.c
…
error-inject.c
…
errseq.c
…
extable.c
…
fault-inject.c
…
fdt_empty_tree.c
…
fdt_ro.c
…
fdt_rw.c
…
fdt_strerror.c
…
fdt_sw.c
…
fdt_wip.c
…
fdt.c
…
find_bit_benchmark.c
…
find_bit.c
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-17 10:48:43 +02:00
flex_array.c
…
flex_proportions.c
…
gcd.c
…
gen_crc32table.c
…
gen_crc64table.c
…
genalloc.c
lib/genalloc: fix the overflow when size is too big
2021-01-12 20:10:16 +01:00
glob.c
…
globtest.c
…
hexdump.c
ANDROID: GKI: update the abi .xml file due to hex_to_bin() changes
2022-05-13 09:30:42 +02:00
hweight.c
…
idr.c
idr: fix param name in idr_alloc_cyclic() doc
2023-09-23 10:48:14 +02:00
inflate.c
…
int_sqrt.c
fix int_sqrt64() for very large numbers
2019-01-22 21:40:34 +01:00
interval_tree_test.c
…
interval_tree.c
…
iomap_copy.c
…
iomap.c
…
iommu-helper.c
…
ioremap.c
ANDROID: GKI: export symbols from abi_gki_aarch64_qcom_whitelist
2020-04-13 21:36:41 +00:00
iov_iter.c
lib/iov_iter: initialize "flags" in new pipe_buffer
2022-06-19 17:21:12 +05:30
irq_poll.c
…
irq_regs.c
…
is_single_threaded.c
…
jedec_ddr_data.c
…
kasprintf.c
…
Kconfig
Merge tag 'ASB-2024-02-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
2024-02-06 16:07:32 +02:00
Kconfig.debug
kernel: Add CC_WERROR config to turn warnings into errors
2023-12-22 23:09:07 +00:00
Kconfig.kasan
UPSTREAM: kasan: remove clang version check for KASAN_STACK
2020-11-16 09:22:35 +01:00
Kconfig.kgdb
…
Kconfig.ubsan
…
kfifo.c
Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
2020-01-27 14:51:08 +01:00
klist.c
…
kobject_uevent.c
kobject_uevent: remove warning in init_uevent_argv()
2021-05-22 10:59:47 +02:00
kobject.c
kobject: Fix slab-out-of-bounds in fill_kobj_path()
2023-11-08 11:22:17 +01:00
kstrtox.c
lib: vsprintf: Fix handling of number field widths in vsscanf
2021-07-20 16:15:45 +02:00
kstrtox.h
lib: vsprintf: Fix handling of number field widths in vsscanf
2021-07-20 16:15:45 +02:00
lcm.c
…
libcrc32c.c
…
list_debug.c
lib/list_debug.c: Detect uninitialized lists
2022-08-25 11:15:45 +02:00
list_sort.c
…
llist.c
…
locking-selftest-hardirq.h
…
locking-selftest-mutex.h
…
locking-selftest-rlock-hardirq.h
…
locking-selftest-rlock-softirq.h
…
locking-selftest-rlock.h
…
locking-selftest-rsem.h
…
locking-selftest-rtmutex.h
…
locking-selftest-softirq.h
…
locking-selftest-spin-hardirq.h
…
locking-selftest-spin-softirq.h
…
locking-selftest-spin.h
…
locking-selftest-wlock-hardirq.h
…
locking-selftest-wlock-softirq.h
…
locking-selftest-wlock.h
…
locking-selftest-wsem.h
…
locking-selftest.c
…
lockref.c
…
logic_pio.c
PCI: Fix pci_register_io_range() memory leak
2021-03-17 16:43:46 +01:00
lru_cache.c
…
lshrdi3.c
…
Makefile
Merge tag 'ASB-2024-02-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
2024-02-06 16:07:32 +02:00
memneq.c
UPSTREAM: crypto: memneq - move into lib/
2024-01-23 14:10:10 +00:00
memory-notifier-error-inject.c
…
memweight.c
…
muldi3.c
…
net_utils.c
…
netdev-notifier-error-inject.c
…
nlattr.c
Merge tag 'ASB-2022-08-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
2022-11-24 03:17:53 +02:00
nmi_backtrace.c
…
nodemask.c
nodemask: Fix return values to be unsigned
2022-06-14 16:59:38 +02:00
notifier-error-inject.c
lib/notifier-error-inject: fix error when writing -errno to debugfs file
2023-01-18 11:30:06 +01:00
notifier-error-inject.h
…
of-reconfig-notifier-error-inject.c
…
oid_registry.c
…
once.c
once: add DO_ONCE_SLOW() for sleepable contexts
2022-10-26 13:19:26 +02:00
parman.c
…
parser.c
…
pci_iomap.c
…
percpu_counter.c
…
percpu_test.c
…
percpu-refcount.c
…
plist.c
ANDROID: GKI: export symbols from abi_gki_aarch64_qcom_whitelist
2020-04-13 21:36:41 +00:00
pm-notifier-error-inject.c
…
prime_numbers.c
…
radix-tree.c
treewide: Remove uninitialized_var() usage
2023-08-11 11:45:01 +02:00
random32.c
random: replace custom notifier chain with standard one
2022-06-25 11:49:08 +02:00
ratelimit.c
ratelimit: Fix data-races in ___ratelimit().
2022-09-05 10:26:30 +02:00
rational.c
…
rbtree_test.c
…
rbtree.c
…
reciprocal_div.c
…
refcount.c
lib: refcount: Cause kernel panic on refcount error detection
2018-12-06 11:16:48 -08:00
rhashtable.c
rhashtable: Still do rehash when we get EEXIST
2019-04-03 06:26:17 +02:00
sbitmap.c
sbitmap: fix improper use of smp_mb__before_atomic()
2019-05-31 06:46:00 -07:00
scatterlist.c
sgl_alloc_order: fix memory leak
2020-11-05 11:08:45 +01:00
seq_buf.c
seq_buf: Fix overflow in seq_buf_putmem_hex()
2021-07-20 16:16:05 +02:00
sg_pool.c
…
sg_split.c
…
sha1.c
lib/crypto: sha1: re-roll loops to reduce code size
2022-06-25 11:48:58 +02:00
sha256.c
…
show_mem.c
…
siphash.c
siphash: use one source of truth for siphash permutations
2022-06-25 11:49:11 +02:00
smp_processor_id.c
…
sort.c
…
stackdepot.c
Merge tag 'ASB-2022-08-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
2022-11-24 03:17:53 +02:00
stmp_device.c
…
string_helpers.c
…
string.c
lib/string: Add strscpy_pad() function
2021-02-13 13:51:15 +01:00
strncpy_from_user.c
Merge 4.19.129 into android-4.19-stable
2020-06-22 10:50:54 +02:00
strnlen_user.c
BACKPORT: lib: introduce copy_struct_from_user() helper
2022-12-28 03:53:16 +00:00
syscall.c
…
test_bitfield.c
…
test_bitmap.c
…
test_bpf.c
bpf/tests: Do not PASS tests without actually testing the result
2021-09-22 11:48:04 +02:00
test_debug_virtual.c
lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
2019-01-13 09:51:10 +01:00
test_firmware.c
test_firmware: prevent race conditions by a correct implementation of locking
2023-08-30 16:31:50 +02:00
test_hash.c
…
test_hexdump.c
test_hexdump: use memcpy instead of strncpy
2018-12-08 12:59:06 +01:00
test_ida.c
test_ida: Fix lockdep warning
2018-10-15 16:31:29 -04:00
test_kasan.c
Merge 4.19.103 into android-4.19
2020-02-11 15:05:03 -08:00
test_kmod.c
lib/test: use after free in register_test_dev_kmod()
2022-04-15 14:14:53 +02:00
test_list_sort.c
…
test_meminit.c
UPSTREAM: lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
2023-03-01 14:08:00 +00:00
test_module.c
…
test_overflow.c
lib/test_overflow.c: avoid tainting the kernel and fix wrap size
2019-08-06 19:06:51 +02:00
test_parman.c
…
test_printf.c
…
test_rhashtable.c
lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically
2019-02-12 19:47:21 +01:00
test_siphash.c
…
test_sort.c
…
test_stackinit.c
UPSTREAM: lib/test_stackinit: Fix static initializer test
2023-03-01 12:09:29 +00:00
test_static_key_base.c
…
test_static_keys.c
…
test_string.c
lib/test_string.c: avoid masking memset16/32/64 failures
2019-08-06 19:06:51 +02:00
test_sysctl.c
…
test_ubsan.c
…
test_user_copy.c
UPSTREAM: usercopy: Avoid soft lockups in test_check_nonzero_user()
2024-01-17 16:22:40 +00:00
test_uuid.c
…
test-kstrtox.c
…
test-string_helpers.c
…
textsearch.c
lib: textsearch: fix escapes in example code
2019-10-29 09:19:35 +01:00
timerqueue.c
Revert "lib/timerqueue: Rely on rbtree semantics for next timer"
2021-10-13 12:15:04 +02:00
ts_bm.c
lib/ts_bm: reset initial match offset for every block of text
2023-08-11 11:45:07 +02:00
ts_fsm.c
…
ts_kmp.c
…
ubsan.c
ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
2019-05-10 17:54:04 +02:00
ubsan.h
…
ucmpdi2.c
…
ucs2_string.c
…
usercopy.c
Merge 4.19.274 into android-4.19-stable
2023-02-25 15:35:59 +00:00
uuid.c
…
vsprintf.c
Merge tag 'ASB-2022-08-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
2022-11-24 03:17:53 +02:00
win_minmax.c
…
xxhash.c
…