d5e7cafd69
If the part of the compression data are corrupted, or the compression data is totally fake, the memory access over the limit is possible. This is the log from my system usning lz4 decompression. [6502]data abort, halting [6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc [6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000 [6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000 [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc [6528]spsr 0x400001f3 and the memory addresses of some variables at the moment are ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000 As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory over @oend. Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
fonts | ||
lz4 | ||
lzo | ||
mpi | ||
raid6 | ||
reed_solomon | ||
xz | ||
zlib_deflate | ||
zlib_inflate | ||
.gitignore | ||
argv_split.c | ||
asn1_decoder.c | ||
assoc_array.c | ||
atomic64.c | ||
atomic64_test.c | ||
audit.c | ||
average.c | ||
bcd.c | ||
bch.c | ||
bitmap.c | ||
bitrev.c | ||
bsearch.c | ||
btree.c | ||
bug.c | ||
build_OID_registry | ||
bust_spinlocks.c | ||
check_signature.c | ||
checksum.c | ||
clz_ctz.c | ||
clz_tab.c | ||
cmdline.c | ||
compat_audit.c | ||
cordic.c | ||
cpu-notifier-error-inject.c | ||
cpu_rmap.c | ||
cpumask.c | ||
crc-ccitt.c | ||
crc-itu-t.c | ||
crc-t10dif.c | ||
crc7.c | ||
crc8.c | ||
crc16.c | ||
crc32.c | ||
crc32defs.h | ||
ctype.c | ||
debug_locks.c | ||
debugobjects.c | ||
dec_and_lock.c | ||
decompress.c | ||
decompress_bunzip2.c | ||
decompress_inflate.c | ||
decompress_unlz4.c | ||
decompress_unlzma.c | ||
decompress_unlzo.c | ||
decompress_unxz.c | ||
devres.c | ||
digsig.c | ||
div64.c | ||
dma-debug.c | ||
dump_stack.c | ||
dynamic_debug.c | ||
dynamic_queue_limits.c | ||
earlycpio.c | ||
extable.c | ||
fault-inject.c | ||
fdt.c | ||
fdt_empty_tree.c | ||
fdt_ro.c | ||
fdt_rw.c | ||
fdt_strerror.c | ||
fdt_sw.c | ||
fdt_wip.c | ||
find_last_bit.c | ||
find_next_bit.c | ||
flex_array.c | ||
flex_proportions.c | ||
gcd.c | ||
gen_crc32table.c | ||
genalloc.c | ||
glob.c | ||
halfmd4.c | ||
hexdump.c | ||
hweight.c | ||
idr.c | ||
inflate.c | ||
int_sqrt.c | ||
interval_tree.c | ||
interval_tree_test.c | ||
iomap.c | ||
iomap_copy.c | ||
iommu-helper.c | ||
ioremap.c | ||
iov_iter.c | ||
irq_regs.c | ||
is_single_threaded.c | ||
jedec_ddr_data.c | ||
kasprintf.c | ||
Kconfig | ||
Kconfig.debug | ||
Kconfig.kasan | ||
Kconfig.kgdb | ||
Kconfig.kmemcheck | ||
kfifo.c | ||
klist.c | ||
kobject.c | ||
kobject_uevent.c | ||
kstrtox.c | ||
kstrtox.h | ||
lcm.c | ||
libcrc32c.c | ||
list_debug.c | ||
list_sort.c | ||
llist.c | ||
locking-selftest-hardirq.h | ||
locking-selftest-mutex.h | ||
locking-selftest-rlock-hardirq.h | ||
locking-selftest-rlock-softirq.h | ||
locking-selftest-rlock.h | ||
locking-selftest-rsem.h | ||
locking-selftest-softirq.h | ||
locking-selftest-spin-hardirq.h | ||
locking-selftest-spin-softirq.h | ||
locking-selftest-spin.h | ||
locking-selftest-wlock-hardirq.h | ||
locking-selftest-wlock-softirq.h | ||
locking-selftest-wlock.h | ||
locking-selftest-wsem.h | ||
locking-selftest.c | ||
lockref.c | ||
lru_cache.c | ||
Makefile | ||
md5.c | ||
memory-notifier-error-inject.c | ||
memweight.c | ||
net_utils.c | ||
nlattr.c | ||
notifier-error-inject.c | ||
notifier-error-inject.h | ||
of-reconfig-notifier-error-inject.c | ||
oid_registry.c | ||
parser.c | ||
pci_iomap.c | ||
percpu-refcount.c | ||
percpu_counter.c | ||
percpu_ida.c | ||
percpu_test.c | ||
plist.c | ||
pm-notifier-error-inject.c | ||
proportions.c | ||
radix-tree.c | ||
random32.c | ||
ratelimit.c | ||
rational.c | ||
rbtree.c | ||
rbtree_test.c | ||
reciprocal_div.c | ||
rhashtable.c | ||
scatterlist.c | ||
seq_buf.c | ||
sha1.c | ||
show_mem.c | ||
smp_processor_id.c | ||
sort.c | ||
stmp_device.c | ||
string.c | ||
string_helpers.c | ||
strncpy_from_user.c | ||
strnlen_user.c | ||
swiotlb.c | ||
syscall.c | ||
test-hexdump.c | ||
test-kstrtox.c | ||
test-string_helpers.c | ||
test_bpf.c | ||
test_firmware.c | ||
test_kasan.c | ||
test_module.c | ||
test_rhashtable.c | ||
test_user_copy.c | ||
textsearch.c | ||
timerqueue.c | ||
ts_bm.c | ||
ts_fsm.c | ||
ts_kmp.c | ||
ucs2_string.c | ||
usercopy.c | ||
uuid.c | ||
vsprintf.c |