Messages in this thread | | | Date | Fri, 2 Apr 2010 14:57:02 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH] initramfs: prevent buffer overflow when unpacking to rootfs |
| |
On Thu, 1 Apr 2010 12:45:46 +0300 Aaro Koskinen <aaro.koskinen@iki.fi> wrote:
> Garbage in the initrd memory area may result in the unpack routine > accessing memory outside the buffer. The patch adds a check that the > specified area size is not exceeded. > > Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> > Cc: stable <stable@kernel.org> > --- > > The patch prevents the following kernel panic on Amstrad E3: > > Unpacking initramfs... > Unable to handle kernel paging request at virtual address c20121a7 > > ... > > --- a/init/initramfs.c > +++ b/init/initramfs.c > @@ -460,6 +460,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len) > } > if (state != Reset) > error("junk in compressed archive"); > + if (my_inptr >= len) > + break; > this_header = saved_offset + my_inptr; > buf += my_inptr; > len -= my_inptr;
OK, so if I'm understanding this right, the call to
decompress(buf, len, NULL, flush_buffer, NULL, &my_inptr, error);
has gone and generated more output data than it was asked to generate?
If so, isn't that a bug in the decompressor? Which one is your system using?
[ wonders why my_inptr is static, and why the sixth arg to decompress_fn takes an int* while callers are passing in an unsigned* ]
| |