lib/decompressors: use real out buf size for gunzip with kernel

When loading x86 64bit kernel above 4GiB with patched grub2, got kernel
gunzip error.

| early console in decompress_kernel
| decompress_kernel:
|       input: [0x807f2143b4-0x807ff61aee]
|      output: [0x807cc00000-0x807f3ea29b] 0x027ea29c: output_len
| boot via startup_64
| KASLR using RDTSC...
|  new output: [0x46fe000000-0x470138cfff] 0x0338d000: output_run_size
|  decompress: [0x46fe000000-0x47007ea29b] <=== [0x807f2143b4-0x807ff61aee]
|
| Decompressing Linux... gz...
|
| uncompression error
|
| -- System halted

the new buffer is at 0x46fe000000ULL, decompressor_gzip is using
0xffffffb901ffffff as out_len.  gunzip in lib/zlib_inflate/inflate.c cap
that len to 0x01ffffff and decompress fails later.

We could hit this problem with crashkernel booting that uses kexec loading
kernel above 4GiB.

We have decompress_* support:
    1. inbuf[]/outbuf[] for kernel preboot.
    2. inbuf[]/flush() for initramfs
    3. fill()/flush() for initrd.
This bug only affect kernel preboot path that use outbuf[].

Add __decompress and take real out_buf_len for gunzip instead of guessing
wrong buf size.

Fixes: 1431574a1c4 (lib/decompressors: fix "no limit" output buffer length)
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Alexandre Courbot <acourbot@nvidia.com>
Cc: Jon Medhurst <tixy@linaro.org>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
index bd245d34952d2ad2392e9f9399654ac479c431f1..a0765e7ed6c7dd2166b2cb95874fc076532d526c 100644 (file)
--- a/arch/arm/boot/compressed/decompress.c
+++ b/arch/arm/boot/compressed/decompress.c
@@ -57,5 +57,5 @@ extern char * strstr(const char * s1, const char *s2);
 
 int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x))
 {
 
 int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x))
 {

-       return decompress(input, len, NULL, NULL, output, NULL, error);
+       return __decompress(input, len, NULL, NULL, output, 0, NULL, error);

 }
 }

diff --git a/arch/h8300/boot/compressed/misc.c b/arch/h8300/boot/compressed/misc.c
index 704274127c07e9f5c67e074264d82bf08018ddbf..c4f2cfcb117bd6a6b9f1844c3a3313fa5e6be94a 100644 (file)
--- a/arch/h8300/boot/compressed/misc.c
+++ b/arch/h8300/boot/compressed/misc.c
@@ -70,5 +70,5 @@ void decompress_kernel(void)
        free_mem_ptr = (unsigned long)&_end;
        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
 
        free_mem_ptr = (unsigned long)&_end;
        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
 

-       decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+       __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);

 }
 }

diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
index 28a09529f206915fd00633bf846dde48342b8b36..3a76927458681d3785e2ed558a88961ba5b18532 100644 (file)
--- a/arch/m32r/boot/compressed/misc.c
+++ b/arch/m32r/boot/compressed/misc.c
@@ -86,6 +86,7 @@ decompress_kernel(int mmu_on, unsigned char *zimage_data,
        free_mem_end_ptr = free_mem_ptr + BOOT_HEAP_SIZE;
 
        puts("\nDecompressing Linux... ");
        free_mem_end_ptr = free_mem_ptr + BOOT_HEAP_SIZE;
 
        puts("\nDecompressing Linux... ");

-       decompress(input_data, input_len, NULL, NULL, output_data, NULL, error);
+       __decompress(input_data, input_len, NULL, NULL, output_data, 0,
+                       NULL, error);

        puts("done.\nBooting the kernel.\n");
 }
        puts("done.\nBooting the kernel.\n");
 }

diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
index 54831069a206249444b31e40c4c749a37a667aa2..080cd53bac369158481785fd285733e7d5372e8c 100644 (file)
--- a/arch/mips/boot/compressed/decompress.c
+++ b/arch/mips/boot/compressed/decompress.c
@@ -111,8 +111,8 @@ void decompress_kernel(unsigned long boot_heap_start)
        puts("\n");
 
        /* Decompress the kernel with according algorithm */
        puts("\n");
 
        /* Decompress the kernel with according algorithm */

-       decompress((char *)zimage_start, zimage_size, 0, 0,
-                  (void *)VMLINUX_LOAD_ADDRESS_ULL, 0, error);
+       __decompress((char *)zimage_start, zimage_size, 0, 0,
+                  (void *)VMLINUX_LOAD_ADDRESS_ULL, 0, 0, error);

 
        /* FIXME: should we flush cache here? */
        puts("Now, booting the kernel...\n");
 
        /* FIXME: should we flush cache here? */
        puts("Now, booting the kernel...\n");

diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index 42506b371b74144886e42a9ec21d43edcf680566..4da604ebf6fd8edd75eb01951913c79991d0eca5 100644 (file)
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -167,7 +167,7 @@ unsigned long decompress_kernel(void)
 #endif
 
        puts("Uncompressing Linux... ");
 #endif
 
        puts("Uncompressing Linux... ");

-       decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+       __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);

        puts("Ok, booting the kernel.\n");
        return (unsigned long) output;
 }
        puts("Ok, booting the kernel.\n");
        return (unsigned long) output;
 }

diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
index 95470a472d2cf793ddad131f55805385a514e65f..208a9753ab38cd0a532c63b19c379cae8a8494e7 100644 (file)
--- a/arch/sh/boot/compressed/misc.c
+++ b/arch/sh/boot/compressed/misc.c
@@ -132,7 +132,7 @@ void decompress_kernel(void)
 
        puts("Uncompressing Linux... ");
        cache_control(CACHE_ENABLE);
 
        puts("Uncompressing Linux... ");
        cache_control(CACHE_ENABLE);

-       decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+       __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);

        cache_control(CACHE_DISABLE);
        puts("Ok, booting the kernel.\n");
 }
        cache_control(CACHE_DISABLE);
        puts("Ok, booting the kernel.\n");
 }

diff --git a/arch/unicore32/boot/compressed/misc.c b/arch/unicore32/boot/compressed/misc.c
index 176d5bda3559de3ffc23bdc667c0ee7be3f6d5bb..5c65dfee278c0319bcd6059a95249431f836d278 100644 (file)
--- a/arch/unicore32/boot/compressed/misc.c
+++ b/arch/unicore32/boot/compressed/misc.c
@@ -119,8 +119,8 @@ unsigned long decompress_kernel(unsigned long output_start,
        output_ptr = get_unaligned_le32(tmp);
 
        arch_decomp_puts("Uncompressing Linux...");
        output_ptr = get_unaligned_le32(tmp);
 
        arch_decomp_puts("Uncompressing Linux...");

-       decompress(input_data, input_data_end - input_data, NULL, NULL,
-                       output_data, NULL, error);
+       __decompress(input_data, input_data_end - input_data, NULL, NULL,
+                       output_data, 0, NULL, error);

        arch_decomp_puts(" done, booting the kernel.\n");
        return output_ptr;
 }
        arch_decomp_puts(" done, booting the kernel.\n");
        return output_ptr;
 }

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index f63797942bb5951adc91bf5bd4d355ff5e48db6e..79dac1758e7c00d8c062be2e3c2b054bc4dfc475 100644 (file)
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -448,7 +448,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
 #endif
 
        debug_putstr("\nDecompressing Linux... ");
 #endif
 
        debug_putstr("\nDecompressing Linux... ");

-       decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+       __decompress(input_data, input_len, NULL, NULL, output, output_len,
+                       NULL, error);

        parse_elf(output);
        /*
         * 32-bit always performs relocations. 64-bit relocations are only
        parse_elf(output);
        /*
         * 32-bit always performs relocations. 64-bit relocations are only

diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 6dd0335ea61b296b5dfd77818e58e294fb2e805c..0234361b24b89ee09dc452e397bd950a43f69025 100644 (file)
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -743,12 +743,12 @@ exit_0:
 }
 
 #ifdef PREBOOT
 }
 
 #ifdef PREBOOT

-STATIC int INIT decompress(unsigned char *buf, long len,
+STATIC int INIT __decompress(unsigned char *buf, long len,

                        long (*fill)(void*, unsigned long),
                        long (*flush)(void*, unsigned long),
                        long (*fill)(void*, unsigned long),
                        long (*flush)(void*, unsigned long),

-                       unsigned char *outbuf,
+                       unsigned char *outbuf, long olen,

                        long *pos,
                        long *pos,

-                       void(*error)(char *x))
+                       void (*error)(char *x))

 {
        return bunzip2(buf, len - 4, fill, flush, outbuf, pos, error);
 }
 {
        return bunzip2(buf, len - 4, fill, flush, outbuf, pos, error);
 }

diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index d4c7891635ecc2b1fb70b9f4fc75a216c782fe0d..555c06bf20daa83190139392597c4622a00a0e5d 100644 (file)
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -1,4 +1,5 @@
 #ifdef STATIC
 #ifdef STATIC

+#define PREBOOT

 /* Pre-boot environment: included */
 
 /* prevent inclusion of _LINUX_KERNEL_H in pre-boot environment: lots
 /* Pre-boot environment: included */
 
 /* prevent inclusion of _LINUX_KERNEL_H in pre-boot environment: lots


@@ -33,23 +34,23 @@ static long INIT nofill(void *buffer, unsigned long len)
 }
 
 /* Included from initramfs et al code */
 }
 
 /* Included from initramfs et al code */

-STATIC int INIT gunzip(unsigned char *buf, long len,
+STATIC int INIT __gunzip(unsigned char *buf, long len,

                       long (*fill)(void*, unsigned long),
                       long (*flush)(void*, unsigned long),
                       long (*fill)(void*, unsigned long),
                       long (*flush)(void*, unsigned long),

-                      unsigned char *out_buf,
+                      unsigned char *out_buf, long out_len,

                       long *pos,
                       void(*error)(char *x)) {
        u8 *zbuf;
        struct z_stream_s *strm;
        int rc;
                       long *pos,
                       void(*error)(char *x)) {
        u8 *zbuf;
        struct z_stream_s *strm;
        int rc;

-       size_t out_len;

 
        rc = -1;
        if (flush) {
                out_len = 0x8000; /* 32 K */
                out_buf = malloc(out_len);
        } else {
 
        rc = -1;
        if (flush) {
                out_len = 0x8000; /* 32 K */
                out_buf = malloc(out_len);
        } else {

-               out_len = ((size_t)~0) - (size_t)out_buf; /* no limit */
+               if (!out_len)
+                       out_len = ((size_t)~0) - (size_t)out_buf; /* no limit */

        }
        if (!out_buf) {
                error("Out of memory while allocating output buffer");
        }
        if (!out_buf) {
                error("Out of memory while allocating output buffer");


@@ -181,4 +182,24 @@ gunzip_nomem1:
        return rc; /* returns Z_OK (0) if successful */
 }
 
        return rc; /* returns Z_OK (0) if successful */
 }
 

-#define decompress gunzip
+#ifndef PREBOOT
+STATIC int INIT gunzip(unsigned char *buf, long len,
+                      long (*fill)(void*, unsigned long),
+                      long (*flush)(void*, unsigned long),
+                      unsigned char *out_buf,
+                      long *pos,
+                      void (*error)(char *x))
+{
+       return __gunzip(buf, len, fill, flush, out_buf, 0, pos, error);
+}
+#else
+STATIC int INIT __decompress(unsigned char *buf, long len,
+                          long (*fill)(void*, unsigned long),
+                          long (*flush)(void*, unsigned long),
+                          unsigned char *out_buf, long out_len,
+                          long *pos,
+                          void (*error)(char *x))
+{
+       return __gunzip(buf, len, fill, flush, out_buf, out_len, pos, error);
+}
+#endif

diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
index 40f66ebe57b77a0566460a2407bdd713d6e0b3fc..036fc882cd72561a2a96b39314078676fe94ff90 100644 (file)
--- a/lib/decompress_unlz4.c
+++ b/lib/decompress_unlz4.c
@@ -196,12 +196,12 @@ exit_0:
 }
 
 #ifdef PREBOOT
 }
 
 #ifdef PREBOOT

-STATIC int INIT decompress(unsigned char *buf, long in_len,
+STATIC int INIT __decompress(unsigned char *buf, long in_len,

                              long (*fill)(void*, unsigned long),
                              long (*flush)(void*, unsigned long),
                              long (*fill)(void*, unsigned long),
                              long (*flush)(void*, unsigned long),

-                             unsigned char *output,
+                             unsigned char *output, long out_len,

                              long *posp,
                              long *posp,

-                             void(*error)(char *x)
+                             void (*error)(char *x)

        )
 {
        return unlz4(buf, in_len - 4, fill, flush, output, posp, error);
        )
 {
        return unlz4(buf, in_len - 4, fill, flush, output, posp, error);

diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index 0be83af62b884c3dbfa9f29f9630a5ecfd605e2f..decb64629c146b64e770f37ccba89e0cba9e94a3 100644 (file)
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -667,13 +667,12 @@ exit_0:
 }
 
 #ifdef PREBOOT
 }
 
 #ifdef PREBOOT

-STATIC int INIT decompress(unsigned char *buf, long in_len,
+STATIC int INIT __decompress(unsigned char *buf, long in_len,

                              long (*fill)(void*, unsigned long),
                              long (*flush)(void*, unsigned long),
                              long (*fill)(void*, unsigned long),
                              long (*flush)(void*, unsigned long),

-                             unsigned char *output,
+                             unsigned char *output, long out_len,

                              long *posp,
                              long *posp,

-                             void(*error)(char *x)
-       )
+                             void (*error)(char *x))

 {
        return unlzma(buf, in_len - 4, fill, flush, output, posp, error);
 }
 {
        return unlzma(buf, in_len - 4, fill, flush, output, posp, error);
 }

diff --git a/lib/decompress_unlzo.c b/lib/decompress_unlzo.c
index b94a31bdd87d15f34a7f4902eb6170f800c01206..f4c158e3a022aa1af35a6937190d5e0bc90e31ce 100644 (file)
--- a/lib/decompress_unlzo.c
+++ b/lib/decompress_unlzo.c
@@ -31,6 +31,7 @@
  */
 
 #ifdef STATIC
  */
 
 #ifdef STATIC

+#define PREBOOT

 #include "lzo/lzo1x_decompress_safe.c"
 #else
 #include <linux/decompress/unlzo.h>
 #include "lzo/lzo1x_decompress_safe.c"
 #else
 #include <linux/decompress/unlzo.h>


@@ -287,4 +288,14 @@ exit:
        return ret;
 }
 
        return ret;
 }
 

-#define decompress unlzo
+#ifdef PREBOOT
+STATIC int INIT __decompress(unsigned char *buf, long len,
+                          long (*fill)(void*, unsigned long),
+                          long (*flush)(void*, unsigned long),
+                          unsigned char *out_buf, long olen,
+                          long *pos,
+                          void (*error)(char *x))
+{
+       return unlzo(buf, len, fill, flush, out_buf, pos, error);
+}
+#endif

diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
index b07a78340e9d315006a97194fbcccae0c4c16509..25d59a95bd6681465d9e57af06f77c3d641b0649 100644 (file)
--- a/lib/decompress_unxz.c
+++ b/lib/decompress_unxz.c
@@ -394,4 +394,14 @@ error_alloc_state:
  * This macro is used by architecture-specific files to decompress
  * the kernel image.
  */
  * This macro is used by architecture-specific files to decompress
  * the kernel image.
  */

-#define decompress unxz
+#ifdef XZ_PREBOOT
+STATIC int INIT __decompress(unsigned char *buf, long len,
+                          long (*fill)(void*, unsigned long),
+                          long (*flush)(void*, unsigned long),
+                          unsigned char *out_buf, long olen,
+                          long *pos,
+                          void (*error)(char *x))
+{
+       return unxz(buf, len, fill, flush, out_buf, pos, error);
+}
+#endif