Josh Law 30518a75f9 lib/ts_kmp: fix integer overflow in pattern length calculation ...

commit 8cdf30813ea8ce881cecc08664144416dbdb3e16 upstream.

The ts_kmp algorithm stores its prefix_tbl[] table and pattern in a single
allocation sized from the pattern length.  If the prefix_tbl[] size
calculation wraps, the resulting allocation can be too small and
subsequent pattern copies can overflow it.

Fix this by rejecting zero-length patterns and by using overflow helpers
before calculating the combined allocation size.

This fixes a potential heap overflow.  The pattern length calculation can
wrap during a size_t addition, leading to an undersized allocation.
Because the textsearch library is reachable from userspace via Netfilter's
xt_string module, this is a security risk that should be backported to LTS
kernels.

Link: https://lkml.kernel.org/r/20260308202028.2889285-2-objecting@objecting.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2026-06-29 10:45:25 +02:00

..

842

lib: 842: Improve error handling in sw842_compress()

2025-05-08 11:55:42 +02:00

crypto

lib/crypto: blake2s: move hmac construction into wireguard

2022-06-25 11:48:58 +02:00

fonts

Fonts: Replace discarded const qualifier

2020-11-10 12:35:57 +01:00

lz4

…

lzo

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mpi

crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()

2023-09-23 10:48:15 +02:00

raid6

lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3

2022-04-15 14:14:54 +02:00

reed_solomon

rslib: Fix handling of of caller provided syndrome

2019-07-26 09:14:12 +02:00

xz

xz: cleanup CRC32 edits from 2018

2024-11-08 16:19:06 +01:00

zlib_deflate

…

zlib_inflate

lib/zlib: remove outdated and incorrect pre-increment optimization

2020-06-25 15:33:02 +02:00

zstd

lib: zstd: clean up Makefile for simpler composite object handling

2018-03-26 02:01:27 +09:00

.gitignore

lib: add crc64 calculation routines

2018-08-22 10:52:48 -07:00

argv_split.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

ashldi3.c

move libgcc.h to include/linux

2017-12-01 13:09:40 -08:00

ashrdi3.c

move libgcc.h to include/linux

2017-12-01 13:09:40 -08:00

asn1_decoder.c

ASN.1: check for error from ASN1_OP_END__ACT actions

2017-12-08 15:13:27 +00:00

assoc_array.c

assoc_array: Fix BUG_ON during garbage collect

2022-06-06 08:24:20 +02:00

atomic64_test.c

…

atomic64.c

atomics/generic: Define atomic64_fetch_add_unless()

2018-06-21 14:25:21 +02:00

audit.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bcd.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bch.c

lib/bch: fix possible stack overrun

2018-10-12 09:17:46 +02:00

bitmap.c

lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf

2019-12-01 09:17:08 +01:00

bitrev.c

…

bsearch.c

kprobes: Prohibit probing on bsearch()

2019-04-05 22:33:08 +02:00

btree.c

btree: avoid variable-length allocations

2018-03-14 16:55:29 -07:00

bucket_locks.c

ila: make lockdep happy again

2018-08-16 12:14:42 -07:00

bug.c

bug: Remove redundant condition check in report_bug

2021-05-22 10:59:35 +02:00

build_OID_registry

…

bust_spinlocks.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

chacha20.c

crypto: chacha20 - Fix chacha20_block() keystream alignment (again)

2019-11-20 18:47:11 +01:00

check_signature.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

checksum.c

…

clz_ctz.c

lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels

2023-08-30 16:31:55 +02:00

clz_tab.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

cmdline.c

…

cmpdi2.c

move libgcc.h to include/linux

2017-12-01 13:09:40 -08:00

compat_audit.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

cordic.c

…

cpu_rmap.c

lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()

2023-06-14 10:57:13 +02:00

cpumask.c

lib: optimize cpumask_next_and()

2018-02-06 18:32:44 -08:00

crc4.c

…

crc7.c

…

crc8.c

…

crc16.c

…

crc32.c

lib/crc32.c: fix trivial typo in preprocessor condition

2020-10-30 10:38:21 +01:00

crc32defs.h

lib/crc: Move polynomial definition to separate header

2018-07-27 19:04:33 +08:00

crc32test.c

lib/crc32test: remove extra local_irq_disable/enable

2020-11-10 12:35:57 +01:00

crc64.c

lib: add crc64 calculation routines

2018-08-22 10:52:48 -07:00

crc-ccitt.c

lib/crc-ccitt: Add CCITT-FALSE CRC16 variant

2018-01-08 10:08:33 +00:00

crc-itu-t.c

…

crc-t10dif.c

…

ctype.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

debug_info.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

debug_locks.c

locking/lockdep: Fix debug_locks off performance problem

2018-11-13 11:08:20 -08:00

debugobjects.c

debugobjects: Recheck debug_objects_enabled before reporting

2023-08-11 11:45:24 +02:00

dec_and_lock.c

atomic: Add irqsave variant of atomic_dec_and_lock()

2018-06-12 23:33:24 +02:00

decompress_bunzip2.c

decompress_bunzip2: fix rare decompression failure

2024-08-19 05:32:05 +02:00

decompress_inflate.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

decompress_unlz4.c

lib/decompress_unlz4.c: correctly handle zero-padding around initrds.

2021-07-20 16:16:10 +02:00

decompress_unlzma.c

…

decompress_unlzo.c

…

decompress_unxz.c

lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression

2021-11-26 11:36:06 +01:00

decompress.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

devres.c

lib: devres: add a helper function for ioremap_uc

2020-05-10 10:30:11 +02:00

digsig.c

…

div64.c

lib/div64.c: off by one in shift

2019-04-20 09:16:05 +02:00

dump_stack.c

dump_stack: avoid the livelock of the dump_lock

2019-11-12 19:20:37 +01:00

dynamic_debug.c

dyndbg: fix old BUG_ON in >control parser

2024-05-17 11:42:43 +02:00

dynamic_queue_limits.c

dql: Fix dql->limit value when reset.

2025-07-17 10:07:56 +02:00

earlycpio.c

…

error-inject.c

error-injection: Add injectable error types

2018-01-12 17:33:38 -08:00

errseq.c

errseq: Always report a writeback error once

2018-04-27 08:51:26 -04:00

extable.c

…

fault-inject.c

…

fdt_empty_tree.c

…

fdt_ro.c

…

fdt_rw.c

…

fdt_strerror.c

…

fdt_sw.c

…

fdt_wip.c

…

fdt.c

…

find_bit_benchmark.c

lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()

2018-05-11 17:28:45 -07:00

find_bit.c

uapi: rename ext2_swab() to swab() and share globally in swab.h

2020-04-17 10:48:43 +02:00

flex_array.c

…

flex_proportions.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

gcd.c

…

gen_crc32table.c

lib/crc: Use consistent naming for CRC-32 polynomials

2018-07-27 19:04:33 +08:00

gen_crc64table.c

lib: add crc64 calculation routines

2018-08-22 10:52:48 -07:00

genalloc.c

lib/genalloc: fix device leak in of_gen_pool_get()

2025-11-17 10:36:40 +01:00

glob.c

…

globtest.c

…

hexdump.c

hex2bin: fix access beyond string end

2022-05-12 12:20:20 +02:00

hweight.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

idr.c

ida: Fix crash in ida_free when the bitmap is empty

2024-09-04 13:13:08 +02:00

inflate.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

int_sqrt.c

fix int_sqrt64() for very large numbers

2019-01-22 21:40:34 +01:00

interval_tree_test.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

interval_tree.c

…

iomap_copy.c

…

iomap.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

iommu-helper.c

iommu-helper: mark iommu_is_span_boundary as inline

2018-05-09 06:55:44 +02:00

ioremap.c

ioremap: Update pgtable free interfaces with addr

2018-07-04 21:37:08 +02:00

iov_iter.c

lib/iov_iter: initialize "flags" in new pipe_buffer

2022-02-23 11:58:41 +01:00

irq_poll.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

irq_regs.c

…

is_single_threaded.c

…

jedec_ddr_data.c

…

kasprintf.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE

2022-03-23 09:10:41 +01:00

Kconfig.debug

Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled

2022-12-08 11:18:34 +01:00

Kconfig.kasan

kasan: only select SLUB_DEBUG with SYSFS=y

2018-07-26 19:38:03 -07:00

Kconfig.kgdb

…

Kconfig.ubsan

lib/ubsan: remove null-pointer checks

2018-08-10 20:19:58 -07:00

kfifo.c

Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"

2020-01-27 14:51:08 +01:00

klist.c

scsi: klist: Make it safe to use klists in atomic context

2018-07-02 16:20:23 -04:00

kobject_uevent.c

kobject_uevent: Fix OOB access within zap_modalias_env()

2024-08-19 05:32:05 +02:00

kobject.c

kobject: Fix slab-out-of-bounds in fill_kobj_path()

2023-11-08 11:22:17 +01:00

kstrtox.c

lib: vsprintf: Fix handling of number field widths in vsscanf

2021-07-20 16:15:45 +02:00

kstrtox.h

lib: vsprintf: Fix handling of number field widths in vsscanf

2021-07-20 16:15:45 +02:00

lcm.c

…

libcrc32c.c

libcrc32c: Add crc32c_impl function

2018-03-26 15:09:38 +02:00

list_debug.c

lib/list_debug.c: Detect uninitialized lists

2022-08-25 11:15:45 +02:00

list_sort.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

llist.c

…

locking-selftest-hardirq.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-mutex.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-rsem.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-rtmutex.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-softirq.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest-wsem.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

locking-selftest.c

locking: Implement an algorithm choice for Wound-Wait mutexes

2018-07-03 09:44:36 +02:00

lockref.c

lockref: Add lockref_put_not_zero

2018-04-12 09:41:19 -07:00

logic_pio.c

PCI: Fix pci_register_io_range() memory leak

2021-03-17 16:43:46 +01:00

lru_cache.c

treewide: kzalloc() -> kcalloc()

2018-06-12 16:19:22 -07:00

lshrdi3.c

move libgcc.h to include/linux

2017-12-01 13:09:40 -08:00

Makefile

crypto: blake2s - generic C library implementation and selftest

2022-06-25 11:48:58 +02:00

memory-notifier-error-inject.c

…

memweight.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

muldi3.c

move libgcc.h to include/linux

2017-12-01 13:09:40 -08:00

net_utils.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

netdev-notifier-error-inject.c

…

nlattr.c

net: fix nla_strcmp to handle more then one trailing null character

2021-05-22 10:59:44 +02:00

nmi_backtrace.c

printk/nmi: Prevent deadlock when accessing the main log buffer in NMI

2018-07-09 14:10:40 +02:00

nodemask.c

nodemask: Fix return values to be unsigned

2022-06-14 16:59:38 +02:00

notifier-error-inject.c

lib/notifier-error-inject: fix error when writing -errno to debugfs file

2023-01-18 11:30:06 +01:00

notifier-error-inject.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

of-reconfig-notifier-error-inject.c

…

oid_registry.c

509: fix printing uninitialized stack memory when OID is empty

2017-12-08 15:13:28 +00:00

once.c

once: add DO_ONCE_SLOW() for sleepable contexts

2022-10-26 13:19:26 +02:00

parman.c

…

parser.c

…

pci_iomap.c

PCI: Add SPDX GPL-2.0 when no license was specified

2018-01-26 11:45:16 -06:00

percpu_counter.c

notifier: Remove notifier header file wherever not used

2018-08-30 12:56:40 +02:00

percpu_test.c

…

percpu-refcount.c

percpu_ref: Update doc to dissuade users from depending on internal RCU grace periods

2018-03-19 10:09:44 -07:00

plist.c

…

pm-notifier-error-inject.c

…

prime_numbers.c

…

radix-tree.c

treewide: Remove uninitialized_var() usage

2023-08-11 11:45:01 +02:00

random32.c

random: replace custom notifier chain with standard one

2022-06-25 11:49:08 +02:00

ratelimit.c

ratelimit: Fix data-races in ___ratelimit().

2022-09-05 10:26:30 +02:00

rational.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rbtree_test.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

rbtree.c

lib/rbtree,drm/mm: add rbtree_replace_node_cached()

2017-12-14 16:00:48 -08:00

reciprocal_div.c

lib: reciprocal_div: implement the improved algorithm on the paper mentioned

2018-07-07 01:45:31 +02:00

refcount.c

Merge tag 'v4.18-rc5' into locking/core, to pick up fixes

2018-07-17 09:27:43 +02:00

rhashtable.c

rhashtable: Still do rehash when we get EEXIST

2019-04-03 06:26:17 +02:00

sbitmap.c

sbitmap: fix improper use of smp_mb__before_atomic()

2019-05-31 06:46:00 -07:00

scatterlist.c

sgl_alloc_order: fix memory leak

2020-11-05 11:08:45 +01:00

seq_buf.c

seq_buf: Fix overflow in seq_buf_putmem_hex()

2021-07-20 16:16:05 +02:00

sg_pool.c

…

sg_split.c

lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets

2025-06-04 11:49:02 +02:00

sha1.c

lib/crypto: sha1: re-roll loops to reduce code size

2022-06-25 11:48:58 +02:00

sha256.c

kernel/kexec_file.c: move purgatories sha256 to common code

2018-04-13 17:10:28 -07:00

show_mem.c

…

siphash.c

siphash: use one source of truth for siphash permutations

2022-06-25 11:49:11 +02:00

smp_processor_id.c

lib: do not use print_symbol()

2018-01-05 15:24:00 +01:00

sort.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

stackdepot.c

stackdepot: respect __GFP_NOLOCKDEP allocation flag

2024-05-02 16:17:13 +02:00

stmp_device.c

…

string_helpers.c

lib: string_helpers: silence snprintf() output truncation warning

2024-12-05 10:59:41 +01:00

string.c

lib/string: Add strscpy_pad() function

2021-02-13 13:51:15 +01:00

strncpy_from_user.c

lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()

2020-06-22 09:04:59 +02:00

strnlen_user.c

lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()

2020-06-22 09:04:59 +02:00

syscall.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

test_bitfield.c

bitfield: add tests

2018-06-27 18:58:49 +03:00

test_bitmap.c

lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly

2018-05-18 17:17:12 -07:00

test_bpf.c

bpf/tests: Do not PASS tests without actually testing the result

2021-09-22 11:48:04 +02:00

test_debug_virtual.c

lib: fix build failure in CONFIG_DEBUG_VIRTUAL test

2019-01-13 09:51:10 +01:00

test_firmware.c

test_firmware: prevent race conditions by a correct implementation of locking

2023-08-30 16:31:50 +02:00

test_hash.c

…

test_hexdump.c

test_hexdump: use memcpy instead of strncpy

2018-12-08 12:59:06 +01:00

test_ida.c

ida: Fix crash in ida_free when the bitmap is empty

2024-09-04 13:13:08 +02:00

test_kasan.c

lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()

2020-02-11 04:33:57 -08:00

test_kmod.c

lib/test: use after free in register_test_dev_kmod()

2022-04-15 14:14:53 +02:00

test_list_sort.c

lib/test: delete five error messages for failed memory allocations

2017-11-17 16:10:01 -08:00

test_module.c

…

test_overflow.c

overflow: Implement size_t saturating arithmetic helpers

2024-09-04 13:13:00 +02:00

test_parman.c

…

test_printf.c

Revert "lib/test_printf.c: call wait_for_random_bytes() before plain %p tests"

2018-06-25 13:44:20 +02:00

test_rhashtable.c

lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically

2019-02-12 19:47:21 +01:00

test_siphash.c

…

test_sort.c

lib/test_sort.c: add module unload support

2018-02-06 18:32:45 -08:00

test_static_key_base.c

…

test_static_keys.c

…

test_string.c

lib/test_string.c: avoid masking memset16/32/64 failures

2019-08-06 19:06:51 +02:00

test_sysctl.c

…

test_ubsan.c

lib/test_ubsan.c: make test_ubsan_misaligned_access() static

2018-04-11 10:28:35 -07:00

test_user_copy.c

treewide: simplify Kconfig dependencies for removed archs

2018-03-26 15:55:57 +02:00

test_uuid.c

…

test-kstrtox.c

…

test-string_helpers.c

…

textsearch.c

lib: textsearch: fix escapes in example code

2019-10-29 09:19:35 +01:00

timerqueue.c

lib/timerqueue: Rely on rbtree semantics for next timer

2021-10-09 14:11:04 +02:00

ts_bm.c

lib/ts_bm: reset initial match offset for every block of text

2023-08-11 11:45:07 +02:00

ts_fsm.c

…

ts_kmp.c

lib/ts_kmp: fix integer overflow in pattern length calculation

2026-06-29 10:45:25 +02:00

ubsan.c

ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings

2019-05-10 17:54:04 +02:00

ubsan.h

lib/ubsan: remove returns-nonnull-attribute checks

2018-02-06 18:32:46 -08:00

ucmpdi2.c

Add notrace to lib/ucmpdi2.c

2018-04-23 16:39:35 +01:00

ucs2_string.c

lib/ucs2_string.c: add MODULE_LICENSE()

2018-06-07 17:34:39 -07:00

usercopy.c

uaccess: Add speculation barrier to copy_from_user()

2023-02-25 11:51:51 +01:00

uuid.c

Documentation: add UUID/GUID to kernel-api

2017-12-11 15:03:08 -07:00

vsprintf.c

random: replace custom notifier chain with standard one

2022-06-25 11:49:08 +02:00

win_minmax.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xxhash.c

…