Re: [PATCH v1 0/3] lib/842: reject malformed streams before invalid memory accesses

[Herbert Xu <herbert@gondor.apana.org.au>]

On Sat, Aug 29, 2026 at 11:18:48AM +0200, Karl Mehltretter wrote:
> sw842_decompress() backs the crypto 842 algorithm, the NX-842 software
> fallback and zram's 842 backend. Two malformed-stream checks are missing:
> 
>   - indexed and short-data templates can write beyond the caller's stated
>     output capacity; and
>   - a repeat after one to seven bytes of short data reads before the
>     output buffer.
> 
> The first underflows the unsigned remaining length, so every later capacity
> check passes. The decoder keeps writing past the destination and can
> return success with an output length the caller will trust.
> 
> The decoder already returns errors for format, capacity and CRC problems;
> these two cases perform invalid accesses instead.
> 
> Patches 1 and 2 add the checks. After them every output write site is
> capacity-checked, repeat cannot read before the output, and all input reads
> stay bounded. Patch 3 adds KUnit cases for the three malformed streams and
> for three valid streams at the exact acceptance boundaries, so the new
> rejections cannot regress into off-by-one.
> 
> The KMSAN reports from
> syzbot+e774233ff687aada969e and syzbot+8f77ff6144a73f0cf71b are unrelated.
> They trace poison from uninitialized swapped-page storage, not these bounds
> failures.
> 
> KUnit under QEMU 10.2.1 TCG, two vCPUs:
> 
>                   baseline      fixed
>   i386              3/6          6/6
>   x86_64            3/6          6/6
> 
> Baseline runs applied patch 3 alone: the three boundary cases pass, the
> three malformed streams wrongly return success. A fixed x86_64 lockdep
> kernel also passes 6/6.
> 
> Separately, an x86_64 KASAN QEMU run exercised all three malformed cases
> through zram's compressed writeback path by corrupting the backing-disk
> contents after writeback. The baseline reported two out-of-bounds writes
> and one out-of-bounds read; fixed readback returned -EIO in all three cases
> without a KASAN report.
> 
> Karl Mehltretter (3):
>   lib/842: reject output overflows from index and short data
>   lib/842: require a complete history block for repeat templates
>   lib/842: add KUnit tests for the decompressor
> 
>  MAINTAINERS                      |   1 +
>  lib/842/842_decompress.c         |   7 +-
>  lib/Kconfig.debug                |  15 ++++
>  lib/tests/842_decompress_kunit.c | 144 +++++++++++++++++++++++++++++++
>  lib/tests/Makefile               |   1 +
>  5 files changed, 167 insertions(+), 1 deletion(-)
>  create mode 100644 lib/tests/842_decompress_kunit.c
> 
> 
> base-commit: cf72cbb39da84b6f02f90c07f33b102fc10b16f0
> -- 
> 2.53.0

All applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt