Bug#1102066: Work in progress

[Logan Gunthorpe]

Hi,

I had some time today to check the status of this. I'm hoping everything
can at least be sorted for the Forky release. GRUB 2.14 now includes the
zstdio module I sent upstream, but Xen PV guests still can't boot
Trixie's zstd-compressed kernels with 2.14-4, for two reasons:

1. debian/patches/insmod-xzio-and-lzopio-on-xen.patch only loads xzio
and lzopio on Xen, so grub.cfg never loads zstdio and the kernel still
fails with "not xen image".

2. My original zstdio patch has a heap overrun. grub_zstdio_open() sizes
its allocation with sizeof(zstdio_t) instead of the struct itself, so
decompression writes 80 bytes past the end of the buffer. Whether that
crashes depends on the heap layout: on one of my guests, loading zstdio
earlier made GRUB abort with "alloc magic is broken" while loading the
initrd.

I've sent the fix to grub-devel as "[PATCH] io/zstdio: Fix heap overrun
of the decompression buffers" (GNU's servers are currently down, so it
may take a while to appear in the archive).

Attached are two patches:

  0001 backports the overrun fix to debian/patches/upstream/
  0002 adds insmod zstdio to the Xen line in
       insmod-xzio-and-lzopio-on-xen.patch

Please don't apply 0002 without 0001, or it just enables the overrun for
everyone.

I've also replaced the Trixie packages at
https://staff.deltatee.com/~logang/grub/ with 2.12-9.4, which includes
the fix. Anyone using my earlier builds should probably upgrade lest a
change causes the system to no longer boot.

Fixing Trixie would need the zstdio backport, the overrun fix and the
insmod change together.

Thanks,

Logan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Also-insmod-zstdio-when-booting-a-Xen-guest.patch
Type: text/x-patch
Size: 1805 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-grub-devel/attachments/20261006/f56f4e65/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Backport-fix-for-a-heap-overrun-in-zstdio.patch
Type: text/x-patch
Size: 3493 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-grub-devel/attachments/20261006/f56f4e65/attachment-0001.bin>