[Xen-changelog] [xen stable-4.4] LZ4 : fix the data abort issue

[patchbot@xxxxxxx]

commit ce516e8880b3fedf7a87438534e5df5fdb7613d4
Author:     JeHyeon Yeon <tom.yeon@xxxxxxxxxxxxx>
AuthorDate: Tue Apr 21 09:21:05 2015 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Apr 21 09:21:05 2015 +0200

    LZ4 : fix the data abort issue
    
    If the part of the compression data are corrupted, or the compression
    data is totally fake, the memory access over the limit is possible.
    
    This is the log from my system usning lz4 decompression.
       [6502]data abort, halting
       [6503]r0  0x00000000 r1  0x00000000 r2  0xdcea0ffc r3  0xdcea0ffc
       [6509]r4  0xb9ab0bfd r5  0xdcea0ffc r6  0xdcea0ff8 r7  0xdce80000
       [6515]r8  0x00000000 r9  0x00000000 r10 0x00000000 r11 0xb9a98000
       [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc  0x820149bc
       [6528]spsr 0x400001f3
    and the memory addresses of some variables at the moment are
        ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
    
    As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
    over @oend.
    
    Signed-off-by: JeHyeon Yeon <tom.yeon@xxxxxxxxxxxxx>
    Reviewed-by: David Sterba <dsterba@xxxxxxx>
    [Linux commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc]
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    master commit: fcc17f96c2776eb220e3dee79fd0ad6a624ffcd9
    master date: 2015-03-26 11:19:10 +0100
---
 xen/common/lz4/decompress.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/xen/common/lz4/decompress.c b/xen/common/lz4/decompress.c
index 5cf8f37..94ad591 100644
--- a/xen/common/lz4/decompress.c
+++ b/xen/common/lz4/decompress.c
@@ -132,6 +132,9 @@ static int INIT lz4_uncompress(const unsigned char *source, 
unsigned char *dest,
                        /* Error: request to write beyond destination buffer */
                        if (cpy > oend)
                                goto _output_error;
+                       if ((ref + COPYLENGTH) > oend ||
+                                       (op + COPYLENGTH) > oend)
+                               goto _output_error;
                        LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
                        while (op < cpy)
                                *op++ = *ref++;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog