From:   Nick Terrell <terrelln@meta.com>
To:     Sasha Levin <sashal@kernel.org>
CC:     Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        Vasily Gorbik <gor@linux.ibm.com>,
        Alexander Egorenkov <egorenar@linux.ibm.com>,
        Heiko Carstens <hca@linux.ibm.com>,
        "agordeev@linux.ibm.com" <agordeev@linux.ibm.com>,
        "linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>
Subject: Re: [PATCH AUTOSEL 5.4 09/10] s390/decompressor: specify
 __decompress() buf len to avoid overflow
Thread-Topic: [PATCH AUTOSEL 5.4 09/10] s390/decompressor: specify
 __decompress() buf len to avoid overflow
Thread-Index: AQHZPHh2gr/vRn8GDEKm9yLbCMBoaK7QYfkA
Date:   Wed, 15 Feb 2023 18:44:06 +0000
Message-ID: <E980B710-F76E-4535-A93D-10558A8B1521@fb.com>
References: <20230209111921.1893095-1-sashal@kernel.org>
 <20230209111921.1893095-9-sashal@kernel.org>
In-Reply-To: <20230209111921.1893095-9-sashal@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?1hrxRCbQFk/6U/ReBLP97Hh94ekrL2AQnJewGt4sbRJcEhMoDMBcPJskPyM0?=
 =?us-ascii?Q?US7kyXUMUbJsKsUemeYAqgU8MXGew00zwvXN1S61MwYlRywY5YSxMp91xT6G?=
 =?us-ascii?Q?zTbGKQIOrIHkN9bhbcNETPw4cyoZMFCncrr7t67QprMDEMag24Su5v/A90Qv?=
 =?us-ascii?Q?MbUDzHsuY5qdNafnBf8KECIUzAxiH6W9G+EdqJu92/tEcnmuVMBfC/5tpu2u?=
 =?us-ascii?Q?//whorjv5UInRm7aIZDFfOdNho3rMFVrdRxPinw8rJ96hEZcF6LF8bMTiIxU?=
 =?us-ascii?Q?UDMom/2PxqmYQgDBBv9WAOkJzeMv/Ae7IjXzQDyFjAvD8HFlyAs94Q81hpUL?=
 =?us-ascii?Q?BW6qquAMiCexLM/8SHNqShIozaA/EtIrtYehRajMaorAwFgSEc2IAIl+mA/L?=
 =?us-ascii?Q?AWOeqbA1foooioAKJWmFqZiRdJuSfFCfzCrcsq+zMgWI1h76uH0uYHnjIyHN?=
 =?us-ascii?Q?lyqQpOa1rnHYP/uqEtKHAmUKpwNvGYYeB8YsPvtH/Sv7t3ZD0jLFdYljpcs+?=
 =?us-ascii?Q?K3A6Y1Ee7PwAsoPhKCB5p8IjDqbftbCowaWcdoC4ET+y6ud2o55CNuci7mIQ?=
 =?us-ascii?Q?y7vUmqt6wUMmqRjMJRnQY3hLFn60xkx6l8l52/R086bcZJNvlhVDiKhsoHvU?=
 =?us-ascii?Q?IQmk4ARQz/zxfcLZXmTljkco7x7aCQU+UY/qOVhhR9oK7dr2Y8w+lEV+N1ao?=
 =?us-ascii?Q?CGnhBVBAYbgVkIMlAA06xZbzXM6ZpgzXbzR6/72DpmGQsqcYTSNTjH/Luiat?=
 =?us-ascii?Q?myLnVBLFh+NpPx6ettYc+MzwpRg5U34Ro3zvicR8Nvc9QJ+LyF0UKn4oj51s?=
 =?us-ascii?Q?cspJZVRsiXwYOcgIF0Cbmd0EqwkNBo3G6YfpIeUszxpAidQ6CIScV+jkZIrR?=
 =?us-ascii?Q?O+wZEptcfN67OQ7N3ZVVJOzM/ySBNTha1M//ORqr3sNvyKYL4bwpAsYVKMnj?=
 =?us-ascii?Q?GWFWyUPzOyHbcjBavmGCzQ/0KPBOJcX1naV9tlg6AsBdO2D4Jsq2KSoGVs93?=
 =?us-ascii?Q?EnUGRozcPh+wGd7ce8OsMLcPjQBIloUPthTEKkWD45Dmn7LW3isM0rPqGR1z?=
 =?us-ascii?Q?YsyoW/gkFCcFArzOGmEbxw2yuId3j0k6McRO64tiRwO3KhJLM04wKpIBbEYP?=
 =?us-ascii?Q?pjv90WsO7/S0gJZygPOIipIfqZkRntTGMSJe5vo0K+CzF773b105QyrZ3y/D?=
 =?us-ascii?Q?YGHWKcNUFsJIlGCZVCuaOro+B7y5pyQhuyMUbuJPvyoIAnsrvNQjY2CUG+o2?=
 =?us-ascii?Q?f5jO08qSbZG/BAr2UAN9tFS+036DUkthvF1SBFpkSVpdQN3xxDbzSq9+Gphq?=
 =?us-ascii?Q?VHWSFEa1GRRG3aFGD1ZV5G4pg8avTHjFqQZnCdsefg5B74LNiRWULsJrKi8P?=
 =?us-ascii?Q?2bcBowFthrEh5fpE8ha7JteekkAJhXDEO91npnFQE4lrrHbtT08ipdSaQh5f?=
 =?us-ascii?Q?JjqypD4yvEeZsFOlcD+5k+r92MsJHEUfsXzEz7ws3PKtcAvT6WD5/+FBDtVm?=
 =?us-ascii?Q?9kzo1XnkKQX4dZw6CfBri7ydkJLeOw+nGCPDgbtV2Y9GYachjm1MdTSbcN14?=
 =?us-ascii?Q?pZbubTOLQN7dyEUsqSMbAlkjdjGInGC04/pKjzHAAmtlo3mGNtaiZf5asBd7?=
 =?us-ascii?Q?D/6p+WbAMbyRSN85By3VgDw=3D?=
Content-ID: <A8B485219A64314AA631FBE62E22D1FA@namprd15.prod.outlook.com>
X-OriginatorOrg: meta.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR15MB3667.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fdb7ed21-75b6-4566-5be5-08db0f849e42
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Feb 2023 18:44:06.7837
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: FalWVHhWuF2y5w/PbnR5gMFuzmKag4qfxhBxRv70qugsey4xH+9n4ig3IQRddUM9TCnIAzSHzRMUTg66IQwdfA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR15MB6222
X-Proofpoint-ORIG-GUID: WEGCkRBs8i83opQPoVFzGc73s-Qft6ST
X-Proofpoint-GUID: WEGCkRBs8i83opQPoVFzGc73s-Qft6ST
Content-Type: text/plain; charset="us-ascii"
X-Proofpoint-UnRewURL: 0 URL was un-rewritten
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.170.22
 definitions=2023-02-15_09,2023-02-15_01,2023-02-09_01
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Feb 9, 2023, at 3:19 AM, Sasha Levin <sashal@kernel.org> wrote:
> 
> !-------------------------------------------------------------------|
>  This Message Is From an External Sender
> 
> |-------------------------------------------------------------------!
> 
> From: Vasily Gorbik <gor@linux.ibm.com>
> 
> [ Upstream commit 7ab41c2c08a32132ba8c14624910e2fe8ce4ba4b ]
> 
> Historically calls to __decompress() didn't specify "out_len" parameter
> on many architectures including s390, expecting that no writes beyond
> uncompressed kernel image are performed. This has changed since commit
> 2aa14b1ab2c4 ("zstd: import usptream v1.5.2") which includes zstd library
> commit 6a7ede3dfccb ("Reduce size of dctx by reutilizing dst buffer
> (#2751)"). Now zstd decompression code might store literal buffer in
> the unwritten portion of the destination buffer. Since "out_len" is
> not set, it is considered to be unlimited and hence free to use for
> optimization needs. On s390 this might corrupt initrd or ipl report
> which are often placed right after the decompressor buffer. Luckily the
> size of uncompressed kernel image is already known to the decompressor,
> so to avoid the problem simply specify it in the "out_len" parameter.

Thanks for the CC!

Reviewed-by: Nick Terrell <terrelln@fb. <mailto:terrelln@fb.com>com>

It looks like s390 doesn't use in-place decompression, but x86 does,
and we'll need to backport upstream commit 5b266196a [0] to make
sure we don't overwrite the input buffer.

Best,
Nick Terrell

[0] https://github.com/facebook/zstd/commit/5b266196a41e6a15e21bd4f0eeab43b938db1d90

> Link: https://github.com/facebook/zstd/commit/6a7ede3dfccb
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
> Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
> Link: https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> arch/s390/boot/compressed/decompressor.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/s390/boot/compressed/decompressor.c b/arch/s390/boot/compressed/decompressor.c
> index 45046630c56ac..c42ab33bd4524 100644
> --- a/arch/s390/boot/compressed/decompressor.c
> +++ b/arch/s390/boot/compressed/decompressor.c
> @@ -80,6 +80,6 @@ void *decompress_kernel(void)
> void *output = (void *)decompress_offset;
> 
> __decompress(_compressed_start, _compressed_end - _compressed_start,
> -     NULL, NULL, output, 0, NULL, error);
> +     NULL, NULL, output, vmlinux.image_size, NULL, error);
> return output;
> }
> -- 
> 2.39.0
>