From 0b3c03589f877becdf03fd12ea2c962a3a62c0bd Mon Sep 17 00:00:00 2001 From: Logan Gunthorpe Date: Tue, 6 Oct 2026 13:38:04 -0600 Subject: [PATCH 1/2] Backport fix for a heap overrun in zstdio zstdio sizes its buffer allocation with the size of a pointer rather than of struct zstdio, so decompressing writes 80 bytes past the end of the allocation. Booting a zstd-compressed kernel on Xen can then abort with "alloc magic is broken". --- debian/changelog | 7 ++++ debian/patches/series | 1 + ...ap-overrun-of-the-decompression-buff.patch | 38 +++++++++++++++++++ 3 files changed, 46 insertions(+) create mode 100644 debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch diff --git a/debian/changelog b/debian/changelog index a195a1177851..8a236e0b323f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +grub2 (2.14-5) UNRELEASED; urgency=medium + + [ Logan Gunthorpe ] + * Backport fix for a heap overrun in zstdio + + -- Logan Gunthorpe Tue, 06 Oct 2026 11:28:34 -0600 + grub2 (2.14-4) unstable; urgency=medium [ Trupti Shirsat ] diff --git a/debian/patches/series b/debian/patches/series index 60a5ea3d2570..7be76c089082 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -77,3 +77,4 @@ upstream/fix-for-gcc-2.16-2.patch upstream/fix-for-gcc-2.16-3.patch upstream/fix-for-gcc-2.16-4.patch upstream/efi-sb-Fix-boot-failure-when-shim-validation-is-disa.patch +upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch diff --git a/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch b/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch new file mode 100644 index 000000000000..7b5eb83c47c1 --- /dev/null +++ b/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch @@ -0,0 +1,38 @@ +From 1ad657b740ab302c9c204ef6ec52db9c748b9e21 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe +Date: Tue, 6 Oct 2026 12:00:13 -0600 +Subject: [PATCH] io/zstdio: Fix heap overrun of the decompression buffers + +grub_zstdio_open() sizes its allocation with sizeof (zstdio_t), which is +the pointer typedef rather than struct zstdio. The buffers in bufs[] +therefore start sizeof (struct zstdio) - sizeof (zstdio_t) bytes (80 on +x86_64) further into the allocation than it allows for, and every full +output chunk writes that many bytes past its end. + +On a Xen PV guest booting a zstd-compressed kernel this corrupts the heap +and GRUB aborts with "alloc magic is broken" while loading the initrd. +(Though, this may depend on what happens to follow the allocation.) + +Fixes: 8ea83c3ee (io/zstdio: Implement zstdio decompression) +Signed-off-by: Logan Gunthorpe + +--- + grub-core/io/zstdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/io/zstdio.c b/grub-core/io/zstdio.c +index 379eba0c6e00..c3807379097a 100644 +--- a/grub-core/io/zstdio.c ++++ b/grub-core/io/zstdio.c +@@ -81,7 +81,7 @@ grub_zstdio_open (grub_file_t io, enum grub_file_type type) + if (file == NULL) + return NULL; + +- zstdio = grub_zalloc (sizeof (zstdio_t) + ZSTD_DStreamInSize () + ++ zstdio = grub_zalloc (sizeof (*zstdio) + ZSTD_DStreamInSize () + + ZSTD_DStreamOutSize ()); + if (zstdio == NULL) + { +-- +2.47.3 + -- 2.47.3