This is a note to let you know that I've just added the patch titled
lzo: properly check for overruns
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lzo-properly-check-for-overruns.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 206a81c18401c0cde6e579164f752c4b147324ce Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Jun 2014 22:00:53 -0700
Subject: lzo: properly check for overruns
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.
The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types. Modify the checking logic to properly
detect overruns before they happen.
Reported-by: "Don A. Bailey" <donb@xxxxxxxxxxxxxxxxx>
Tested-by: "Don A. Bailey" <donb@xxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
lib/lzo/lzo1x_decompress_safe.c | 62 ++++++++++++++++++++++++++--------------
1 file changed, 41 insertions(+), 21 deletions(-)
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
#include <linux/lzo.h>
#include "lzodefs.h"
-#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x) \
+ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
+ (((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x) \
+ (((size_t)(op_end - op) >= (size_t)(t + x)) && \
+ (((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x) \
+ do { \
+ if (!HAVE_IP(t, x)) \
+ goto input_overrun; \
+ } while (0)
+
+#define NEED_OP(t, x) \
+ do { \
+ if (!HAVE_OP(t, x)) \
+ goto output_overrun; \
+ } while (0)
+
+#define TEST_LB(m_pos) \
+ do { \
+ if ((m_pos) < out) \
+ goto lookbehind_overrun; \
+ } while (0)
int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 15 + *ip++;
}
t += 3;
copy_literal_run:
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
const unsigned char *ie = ip + t;
unsigned char *oe = op + t;
do {
@@ -81,8 +101,8 @@ copy_literal_run:
} else
#endif
{
- NEED_OP(t);
- NEED_IP(t + 3);
+ NEED_OP(t, 0);
+ NEED_IP(t, 3);
do {
*op++ = *ip++;
} while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
m_pos -= t >> 2;
m_pos -= *ip++ << 2;
TEST_LB(m_pos);
- NEED_OP(2);
+ NEED_OP(2, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 31 + *ip++;
- NEED_IP(2);
+ NEED_IP(2, 0);
}
m_pos = op - 1;
next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 7 + *ip++;
- NEED_IP(2);
+ NEED_IP(2, 0);
}
next = get_unaligned_le16(ip);
ip += 2;
@@ -154,7 +174,7 @@ copy_literal_run:
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
if (op - m_pos >= 8) {
unsigned char *oe = op + t;
- if (likely(HAVE_OP(t + 15))) {
+ if (likely(HAVE_OP(t, 15))) {
do {
COPY8(op, m_pos);
op += 8;
@@ -164,7 +184,7 @@ copy_literal_run:
m_pos += 8;
} while (op < oe);
op = oe;
- if (HAVE_IP(6)) {
+ if (HAVE_IP(6, 0)) {
state = next;
COPY4(op, ip);
op += next;
@@ -172,7 +192,7 @@ copy_literal_run:
continue;
}
} else {
- NEED_OP(t);
+ NEED_OP(t, 0);
do {
*op++ = *m_pos++;
} while (op < oe);
@@ -181,7 +201,7 @@ copy_literal_run:
#endif
{
unsigned char *oe = op + t;
- NEED_OP(t);
+ NEED_OP(t, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -194,15 +214,15 @@ match_next:
state = next;
t = next;
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
COPY4(op, ip);
op += t;
ip += t;
} else
#endif
{
- NEED_IP(t + 3);
- NEED_OP(t);
+ NEED_IP(t, 3);
+ NEED_OP(t, 0);
while (t > 0) {
*op++ = *ip++;
t--;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-3.14/net-move-the-permission-check-in.patch
queue-3.14/usb-cdc-acm-fix-i-o-after-failed-open.patch
queue-3.14/net-tunnels-enable-module-autoloading.patch
queue-3.14/iio-fix-endianness-issue-in-ak8975_read_axis.patch
queue-3.14/usb-cdc-acm-fix-write-and-resume-race.patch
queue-3.14/staging-iio-tsl2x7x_core-fix-proximity-treshold.patch
queue-3.14/usb-cdc-acm-fix-runtime-pm-for-control-messages.patch
queue-3.14/udp-ipv4-do-not-waste-time-in.patch
queue-3.14/net-qmi_wwan-add-olivetti-olicard-modems.patch
queue-3.14/usb-cdc-acm-fix-broken-runtime-suspend.patch
queue-3.14/net-add-variants-of-capable-for-use-on-on-sockets.patch
queue-3.14/tcp-fix-cwnd-undo-on-dsack-in-f-rto.patch
queue-3.14/net-mlx4_core-keep-only-one-driver-entry-release.patch
queue-3.14/asoc-max98090-fix-reset-at-resume-time.patch
queue-3.14/netlink-rate-limit-leftover-bytes-warning-and-print.patch
queue-3.14/ipip-sit-fix-ipv4_-update_pmtu-redirect-calls.patch
queue-3.14/sctp-fix-sk_ack_backlog-wrap-around-problem.patch
queue-3.14/team-fix-mtu-setting.patch
queue-3.14/lz4-ensure-length-does-not-wrap.patch
queue-3.14/net-fix-inet_getid-and-ipv6_select_ident-bugs.patch
queue-3.14/sh_eth-fix-sh7619-771x-support.patch
queue-3.14/vxlan-use-dev-needed_headroom-instead-of.patch
queue-3.14/rtc-rtc-at91rm9200-fix-infinite-wait-for-ackupd-irq.patch
queue-3.14/ipv6-fix-regression-caused-by-efe4208-in.patch
queue-3.14/net-use-netlink_ns_capable-to-verify-the-permisions.patch
queue-3.14/sfc-pio-restrict-to-64bit-arch-and-use-64-bit-writes.patch
queue-3.14/sh_eth-use-rnc-mode-for-packet-reception.patch
queue-3.14/iio-mxs-lradc-fix-divider.patch
queue-3.14/rtnetlink-fix-userspace-api-breakage-for-iproute2.patch
queue-3.14/net-mlx4_core-preserve-pci_dev_data-after.patch
queue-3.14/net-filter-fix-typo-in-sparc-bpf-jit.patch
queue-3.14/evm-prohibit-userspace-writing-security.evm-hmac-value.patch
queue-3.14/arm-at91-fix-at91_sysirq_mask_rtc-for-sam9x5-socs.patch
queue-3.14/net-filter-fix-sparc32-typo.patch
queue-3.14/ima-introduce-ima_kernel_read.patch
queue-3.14/drivers-hv-balloon-ensure-pressure-reports-are-posted-regularly.patch
queue-3.14/usb-cdc-acm-fix-potential-urb-leak-and-pm-imbalance-in-write.patch
queue-3.14/mips-kvm-allocate-at-least-16kb-for-exception-handlers.patch
queue-3.14/kvm-lapic-sync-highest-isr-to-hardware-apic-on-eoi.patch
queue-3.14/usb-cdc-acm-fix-runtime-pm-imbalance-at-shutdown.patch
queue-3.14/iio-fix-two-mpl3115-issues-in-measurement-conversion.patch
queue-3.14/qlcnic-info-leak-in-qlcnic_dcb_peer_app_info.patch
queue-3.14/usb-cdc-acm-fix-shutdown-and-suspend-race.patch
queue-3.14/ipv4-fix-a-race-in-ip4_datagram_release_cb.patch
queue-3.14/bridge-prevent-insertion-of-fdb-entry-with-disallowed.patch
queue-3.14/asoc-dapm-make-sure-to-always-update-the-dapm-graph-in-_put_volsw.patch
queue-3.14/iio-adc-max1363-incorrect-resolutions-for-max11604-max11605-max11610-and-max11611.patch
queue-3.14/netlink-rename-netlink_capable-netlink_allowed.patch
queue-3.14/net-add-variants-of-capable-for-use-on-netlink.patch
queue-3.14/netlink-only-check-file-credentials-for-implicit.patch
queue-3.14/asoc-tlv320aci3x-fix-custom-snd_soc_dapm_put_volsw_aic3x-function.patch
queue-3.14/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch
queue-3.14/hv-use-correct-order-when-freeing-monitor_pages.patch
queue-3.14/target-fix-null-pointer-dereference-for-xcopy-in-target_put_sess_cmd.patch
queue-3.14/usb-cdc-acm-fix-write-and-suspend-race.patch
queue-3.14/net-force-a-list_del-in-unregister_netdevice_many.patch
queue-3.14/lzo-properly-check-for-overruns.patch
queue-3.14/iio-adc-at91-signedness-bug-in-at91_adc_get_trigger_value_by_name.patch
queue-3.14/ima-audit-log-files-opened-with-o_direct-flag.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html