This is a note to let you know that I've just added the patch titled
lz4: ensure length does not wrap
to the 3.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lz4-ensure-length-does-not-wrap.patch
and it can be found in the queue-3.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 206204a1162b995e2185275167b22468c00d6b36 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Jun 2014 22:01:41 -0700
Subject: lz4: ensure length does not wrap
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 206204a1162b995e2185275167b22468c00d6b36 upstream.
Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen. Catch
this before the wrapping happens and abort the decompression.
Reported-by: "Don A. Bailey" <donb@xxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
lib/lz4/lz4_decompress.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *so
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+ if (unlikely(length > (size_t)(length + len)))
+ goto _output_error;
length += len;
}
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-3.15/usb-cdc-acm-fix-i-o-after-failed-open.patch
queue-3.15/net-tunnels-enable-module-autoloading.patch
queue-3.15/iio-fix-endianness-issue-in-ak8975_read_axis.patch
queue-3.15/usb-cdc-acm-fix-write-and-resume-race.patch
queue-3.15/staging-iio-tsl2x7x_core-fix-proximity-treshold.patch
queue-3.15/usb-cdc-acm-fix-runtime-pm-for-control-messages.patch
queue-3.15/udp-ipv4-do-not-waste-time-in.patch
queue-3.15/net-qmi_wwan-add-olivetti-olicard-modems.patch
queue-3.15/usb-cdc-acm-fix-broken-runtime-suspend.patch
queue-3.15/asoc-max98090-fix-reset-at-resume-time.patch
queue-3.15/ipip-sit-fix-ipv4_-update_pmtu-redirect-calls.patch
queue-3.15/sctp-fix-sk_ack_backlog-wrap-around-problem.patch
queue-3.15/lz4-ensure-length-does-not-wrap.patch
queue-3.15/sh_eth-fix-sh7619-771x-support.patch
queue-3.15/usb-cdc-acm-fix-open-and-suspend-race.patch
queue-3.15/vxlan-use-dev-needed_headroom-instead-of.patch
queue-3.15/rtc-rtc-at91rm9200-fix-infinite-wait-for-ackupd-irq.patch
queue-3.15/ipv6-fix-regression-caused-by-efe4208-in.patch
queue-3.15/sfc-pio-restrict-to-64bit-arch-and-use-64-bit-writes.patch
queue-3.15/sh_eth-use-rnc-mode-for-packet-reception.patch
queue-3.15/iio-mxs-lradc-fix-divider.patch
queue-3.15/rtnetlink-fix-userspace-api-breakage-for-iproute2.patch
queue-3.15/net-filter-fix-typo-in-sparc-bpf-jit.patch
queue-3.15/evm-prohibit-userspace-writing-security.evm-hmac-value.patch
queue-3.15/arm-at91-fix-at91_sysirq_mask_rtc-for-sam9x5-socs.patch
queue-3.15/net-filter-fix-sparc32-typo.patch
queue-3.15/ima-introduce-ima_kernel_read.patch
queue-3.15/drivers-hv-balloon-ensure-pressure-reports-are-posted-regularly.patch
queue-3.15/usb-cdc-acm-fix-potential-urb-leak-and-pm-imbalance-in-write.patch
queue-3.15/kvm-s390-drop-pending-interrupts-on-guest-exit.patch
queue-3.15/mips-kvm-allocate-at-least-16kb-for-exception-handlers.patch
queue-3.15/kvm-lapic-sync-highest-isr-to-hardware-apic-on-eoi.patch
queue-3.15/usb-cdc-acm-fix-runtime-pm-imbalance-at-shutdown.patch
queue-3.15/iio-fix-two-mpl3115-issues-in-measurement-conversion.patch
queue-3.15/usb-cdc-acm-fix-shutdown-and-suspend-race.patch
queue-3.15/ipv4-fix-a-race-in-ip4_datagram_release_cb.patch
queue-3.15/asoc-dapm-make-sure-to-always-update-the-dapm-graph-in-_put_volsw.patch
queue-3.15/iio-adc-max1363-incorrect-resolutions-for-max11604-max11605-max11610-and-max11611.patch
queue-3.15/asoc-tlv320aci3x-fix-custom-snd_soc_dapm_put_volsw_aic3x-function.patch
queue-3.15/iio-adc-checking-for-null-instead-of-is_err-in-probe.patch
queue-3.15/iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch
queue-3.15/hv-use-correct-order-when-freeing-monitor_pages.patch
queue-3.15/target-fix-null-pointer-dereference-for-xcopy-in-target_put_sess_cmd.patch
queue-3.15/usb-cdc-acm-fix-write-and-suspend-race.patch
queue-3.15/net-force-a-list_del-in-unregister_netdevice_many.patch
queue-3.15/lzo-properly-check-for-overruns.patch
queue-3.15/usb-cdc-acm-fix-failed-open-not-being-detected.patch
queue-3.15/iio-adc-at91-signedness-bug-in-at91_adc_get_trigger_value_by_name.patch
queue-3.15/ima-audit-log-files-opened-with-o_direct-flag.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html