diff options
| author | Zhiling Zou <zhilinz@nebusec.ai> | 2026-09-12 21:32:17 +0800 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-10-06 19:03:08 -0700 |
| commit | 2c5c877bb0e94060c4c46e268b0220bdcef8bdc5 (patch) | |
| tree | 1b5a83e0fb554894ee7ac55d9fec0479ae14f078 /tools/lib/python/kdoc/parse_data_structs.py | |
| parent | ba08648b730f06c9d4a604076cca7c26d75967e0 (diff) | |
| download | linux-next-2c5c877bb0e94060c4c46e268b0220bdcef8bdc5.tar.gz linux-next-2c5c877bb0e94060c4c46e268b0220bdcef8bdc5.zip | |
lib: validate in-memory LZ4 chunk length
We found and validated an issue in lib/decompress_unlz4.c. The bug is
reachable by a root user through kexec_file_load() with a crafted external
initrd.
unlz4() reads the compressed chunk length from an in-memory initrd and
passes it to LZ4_decompress_safe(). It only checks the chunk length
against the allocation size when the input is filled by a callback.
Reject an in-memory chunk that extends past the remaining input before
calling the LZ4 decoder. This prevents malformed initrds from making
the decoder read past the mapped archive.
Link: https://lore.kernel.org/59c6555c27aa7ba18ee227f9f02c78d15a37605f.1789219453.git.zhilinz@nebusec.ai
Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel")
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: VEGA <vega@nebusec.ai>
Assisted-by: LLM
Cc: Kyungsik Lee <kyungsik.lee@lge.com>
Diffstat (limited to 'tools/lib/python/kdoc/parse_data_structs.py')
0 files changed, 0 insertions, 0 deletions