This is a note to let you know that I've just added the patch titled
lz4: ensure length does not wrap
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lz4-ensure-length-does-not-wrap.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 206204a1162b995e2185275167b22468c00d6b36 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Jun 2014 22:01:41 -0700
Subject: lz4: ensure length does not wrap
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 206204a1162b995e2185275167b22468c00d6b36 upstream.
Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen. Catch
this before the wrapping happens and abort the decompression.
Reported-by: "Don A. Bailey" <donb@xxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
lib/lz4/lz4_decompress.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *so
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+ if (unlikely(length > (size_t)(length + len)))
+ goto _output_error;
length += len;
}
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-3.14/net-move-the-permission-check-in.patch
queue-3.14/usb-cdc-acm-fix-i-o-after-failed-open.patch
queue-3.14/net-tunnels-enable-module-autoloading.patch
queue-3.14/iio-fix-endianness-issue-in-ak8975_read_axis.patch
queue-3.14/usb-cdc-acm-fix-write-and-resume-race.patch
queue-3.14/staging-iio-tsl2x7x_core-fix-proximity-treshold.patch
queue-3.14/usb-cdc-acm-fix-runtime-pm-for-control-messages.patch
queue-3.14/udp-ipv4-do-not-waste-time-in.patch
queue-3.14/net-qmi_wwan-add-olivetti-olicard-modems.patch
queue-3.14/usb-cdc-acm-fix-broken-runtime-suspend.patch
queue-3.14/net-add-variants-of-capable-for-use-on-on-sockets.patch
queue-3.14/tcp-fix-cwnd-undo-on-dsack-in-f-rto.patch
queue-3.14/net-mlx4_core-keep-only-one-driver-entry-release.patch
queue-3.14/asoc-max98090-fix-reset-at-resume-time.patch
queue-3.14/netlink-rate-limit-leftover-bytes-warning-and-print.patch
queue-3.14/ipip-sit-fix-ipv4_-update_pmtu-redirect-calls.patch
queue-3.14/sctp-fix-sk_ack_backlog-wrap-around-problem.patch
queue-3.14/team-fix-mtu-setting.patch
queue-3.14/lz4-ensure-length-does-not-wrap.patch
queue-3.14/net-fix-inet_getid-and-ipv6_select_ident-bugs.patch
queue-3.14/sh_eth-fix-sh7619-771x-support.patch
queue-3.14/vxlan-use-dev-needed_headroom-instead-of.patch
queue-3.14/rtc-rtc-at91rm9200-fix-infinite-wait-for-ackupd-irq.patch
queue-3.14/ipv6-fix-regression-caused-by-efe4208-in.patch
queue-3.14/net-use-netlink_ns_capable-to-verify-the-permisions.patch
queue-3.14/sfc-pio-restrict-to-64bit-arch-and-use-64-bit-writes.patch
queue-3.14/sh_eth-use-rnc-mode-for-packet-reception.patch
queue-3.14/iio-mxs-lradc-fix-divider.patch
queue-3.14/rtnetlink-fix-userspace-api-breakage-for-iproute2.patch
queue-3.14/net-mlx4_core-preserve-pci_dev_data-after.patch
queue-3.14/net-filter-fix-typo-in-sparc-bpf-jit.patch
queue-3.14/evm-prohibit-userspace-writing-security.evm-hmac-value.patch
queue-3.14/arm-at91-fix-at91_sysirq_mask_rtc-for-sam9x5-socs.patch
queue-3.14/net-filter-fix-sparc32-typo.patch
queue-3.14/ima-introduce-ima_kernel_read.patch
queue-3.14/drivers-hv-balloon-ensure-pressure-reports-are-posted-regularly.patch
queue-3.14/usb-cdc-acm-fix-potential-urb-leak-and-pm-imbalance-in-write.patch
queue-3.14/mips-kvm-allocate-at-least-16kb-for-exception-handlers.patch
queue-3.14/kvm-lapic-sync-highest-isr-to-hardware-apic-on-eoi.patch
queue-3.14/usb-cdc-acm-fix-runtime-pm-imbalance-at-shutdown.patch
queue-3.14/iio-fix-two-mpl3115-issues-in-measurement-conversion.patch
queue-3.14/qlcnic-info-leak-in-qlcnic_dcb_peer_app_info.patch
queue-3.14/usb-cdc-acm-fix-shutdown-and-suspend-race.patch
queue-3.14/ipv4-fix-a-race-in-ip4_datagram_release_cb.patch
queue-3.14/bridge-prevent-insertion-of-fdb-entry-with-disallowed.patch
queue-3.14/asoc-dapm-make-sure-to-always-update-the-dapm-graph-in-_put_volsw.patch
queue-3.14/iio-adc-max1363-incorrect-resolutions-for-max11604-max11605-max11610-and-max11611.patch
queue-3.14/netlink-rename-netlink_capable-netlink_allowed.patch
queue-3.14/net-add-variants-of-capable-for-use-on-netlink.patch
queue-3.14/netlink-only-check-file-credentials-for-implicit.patch
queue-3.14/asoc-tlv320aci3x-fix-custom-snd_soc_dapm_put_volsw_aic3x-function.patch
queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch
queue-3.14/hv-use-correct-order-when-freeing-monitor_pages.patch
queue-3.14/target-fix-null-pointer-dereference-for-xcopy-in-target_put_sess_cmd.patch
queue-3.14/usb-cdc-acm-fix-write-and-suspend-race.patch
queue-3.14/net-force-a-list_del-in-unregister_netdevice_many.patch
queue-3.14/lzo-properly-check-for-overruns.patch
queue-3.14/iio-adc-at91-signedness-bug-in-at91_adc_get_trigger_value_by_name.patch
queue-3.14/ima-audit-log-files-opened-with-o_direct-flag.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html