From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754873AbbCMLWu (ORCPT <rfc822;w@1wt.eu>);
	Fri, 13 Mar 2015 07:22:50 -0400
Received: from cantor2.suse.de ([195.135.220.15]:43474 "EHLO mx2.suse.de"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1750996AbbCMLWt (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 13 Mar 2015 07:22:49 -0400
Date: Fri, 13 Mar 2015 12:22:46 +0100
From: David Sterba <dsterba@suse.cz>
To: "Yeon, JeHyeon (Tom)" <Tom.Yeon@windriver.com>
Cc: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: LZ4 : fix the data abort issue.
Message-ID: <20150313112246.GH20767@twin.jikos.cz>
Reply-To: dsterba@suse.cz
Mail-Followup-To: dsterba@suse.cz,
	"Yeon, JeHyeon (Tom)" <Tom.Yeon@windriver.com>,
	"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
References: <D2D54504A8A67848B028EBEA66F47B9AB2A22E9E@ALA-MBA.corp.ad.wrs.com>
 <20150312074918.GC31132@kroah.com>
 <D2D54504A8A67848B028EBEA66F47B9AB2A2305A@ALA-MBA.corp.ad.wrs.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <D2D54504A8A67848B028EBEA66F47B9AB2A2305A@ALA-MBA.corp.ad.wrs.com>
User-Agent: Mutt/1.5.23.1-rc1 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Mar 12, 2015 at 08:28:55AM +0000, Yeon, JeHyeon (Tom) wrote:
> If the part of the compression data are corrupted, or the compression
> data is totally fake, the memory access over the limit is possible.
> 
> This is the log from my system usning lz4 decompression.
>    [6502]data abort, halting
>    [6503]r0  0x00000000 r1  0x00000000 r2  0xdcea0ffc r3  0xdcea0ffc
>    [6509]r4  0xb9ab0bfd r5  0xdcea0ffc r6  0xdcea0ff8 r7  0xdce80000
>    [6515]r8  0x00000000 r9  0x00000000 r10 0x00000000 r11 0xb9a98000
>    [6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc  0x820149bc
>    [6528]spsr 0x400001f3
> and the memory addresses of some variables at the moment are
>     ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
> 
> As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
> over @oend.
> 
> Signed-off-by: tom.yeon <tom.yeon@windriver.com>

Reviewed-by: David Sterba <dsterba@suse.cz>

Matches implementation in lz4 upstream.

Btw, why is it a reply and not a standalone patch? I don't seem to find
any prior message in relevant mailinglists.