Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Nick Terrell <terrelln@fb.com>
To:     Dave Rodgman <dave.rodgman@arm.com>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Kernel Team <Kernel-team@fb.com>
Subject: Re: Kernel LZO compressor
Thread-Topic: Kernel LZO compressor
Thread-Index: AQHU3pByLhwF/AtNc0KFk3n3IDEkuqYcXBGAgABPxgA=
Date:   Mon, 25 Mar 2019 17:59:27 +0000
Message-ID: <95032476-E8E5-4602-B3FC-60A5219123E3@fb.com>
References: <31D143C0-D64F-4905-B25F-5C3630D38913@fb.com>
 <3996dd23-75ab-1619-8ef4-3025436ed4f8@arm.com>
In-Reply-To: <3996dd23-75ab-1619-8ef4-3025436ed4f8@arm.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-ID: <A1A23587EB245B46BC28E8AF86720E46@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: b8f2dca7-6710-473b-a63f-08d6b14b9fbb
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Mar 2019 17:59:27.8251
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR1501MB1994
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-03-25_10:,,
 signatures=0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Mar 25, 2019, at 6:13 AM, Dave Rodgman <dave.rodgman@arm.com> wrote:
>=20
> On 19/03/2019 8:15 pm, Nick Terrell wrote:
>> Hi Dave,
>>=20
>> I just saw you patches adding LZO-RLE, so I decided to fuzz the LZO
>> compressor and decompressor. I didn't find any crashes, but I found some=
 edge
>> cases in the decompressor.
>=20
> Hi Nick,
>=20
> Thanks - I will take a look at this. These cases won't affect zram, which=
 is
> currently the only place lzo-rle is used, because zram operates over comp=
lete
> pages, but I would prefer not to have this kind of edge case lurking.
>=20
> Presumably the fuzzer generates inputs of various sizes - how large did y=
ou
> test up to?

I tested on inputs up to 4096 bytes large, which is the default, but the fu=
zzing
library libFuzzer has a flag -max_len which allows you to control the maxim=
um
input size.

> thanks
>=20
> Dave
>=20
>>=20
>> After compressing the empty input with lzo1x_1_compress() I get
>> [0x11, 0x00, 0x00] which is rejected by lzo1x_decompress_safe() on line =
60
>> because *ip =3D=3D 17 and in_len < 5 with error LZO_E_INPUT_OVERRUN.
>>=20
>> After compressing the input [0x00] with lzorle1x_1_compress() I get
>> [0x11, 0x01, 0x00, 0x11, 0x00, 0x00] which is rejected by
>> lzo1x_decompress_safe() with error LZO_E_OUTPUT_OVERRUN.
>>=20
>> I ported LZO to userspace by copying the headers from the kernel to
>> userspace and/or rewriting them. The fuzzers and ported LZO are in
>> a GitHub repo so it can be easily reproduced [1]. The compression
>> fuzzer is also included inline below.
>>=20
>> ```
>> #undef NDEBUG
>> #include <string.h>
>> #include <stdint.h>
>> #include <stddef.h>
>> #include <stdlib.h>
>> #include <assert.h>
>> #include <stdio.h>
>>=20
>> #include "lzo.h"
>>=20
>> char wrkmem[LZO1X_MEM_COMPRESS];
>>=20
>> #define RLE 1
>>=20
>> extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) =
{
>>  size_t outSize =3D lzo1x_worst_compress(size);
>>  uint8_t* const out =3D (uint8_t*)malloc(outSize);
>>  assert(out);
>> #if RLE
>>  assert(LZO_E_OK =3D=3D lzorle1x_1_compress(data, size, out, &outSize, w=
rkmem));
>> #else
>>  assert(LZO_E_OK =3D=3D lzo1x_1_compress(data, size, out, &outSize, wrkm=
em));
>> #endif
>>  uint8_t* const rt =3D (uint8_t*)malloc(size);
>>  assert(rt);
>>  size_t rtsize =3D size;
>>  int const ret =3D lzo1x_decompress_safe(out, outSize, rt, &rtsize);
>>  if (ret !=3D LZO_E_OK) {
>>    assert(size < 4);
>>    fprintf(stderr, "INPUT: ");
>>    for (size_t i =3D 0; i < size; ++i)
>>      fprintf(stderr, "%u ", (unsigned)data[i]);
>>    fprintf(stderr, "\nOUTPUT: ");
>>    for (size_t i =3D 0; i < outSize; ++i)
>>      fprintf(stderr, "%u ", (unsigned)out[i]);
>>    fprintf(stderr, "\nret =3D %d\n", ret);
>>  }
>>  assert(ret =3D=3D LZO_E_OK);
>>  assert(rtsize =3D=3D size);
>>  assert(memcmp(data, rt, size) =3D=3D 0);
>>  free(out);
>>  free(rt);
>>  return 0;
>> }
>> ```
>>=20
>> [1] https://github.com/terrelln/lzo-userspace-fuzz
>>=20
>> Best,
>> Nick Terrell
>>=20
>=20
> IMPORTANT NOTICE: The contents of this email and any attachments are conf=
idential and may also be privileged. If you are not the intended recipient,=
 please notify the sender immediately and do not disclose the contents to a=
ny other person, use it for any purpose, or store or copy the information i=
n any medium. Thank you.