Hi

I am using kernel's LZ4-HC for lossless compression for optimization of packets in TrafficSqueezer. So far LZ4-HC is working fine with 32bit kernel mode. But in 64bit machine, it is creating trouble. I did lot of debugging and finally pointed the source of the problem lies purely within LZ4-HC kernel crypto library.

I am also facing buffer overrun issues with LZ4-HC 64bit mode.

I reported to the guy who ported LZ4-HC within kernel, so far I didnt got any reply. Is there someone who are facing similar issue ?

Awaiting your help.
Thank you.

File it as a kernel bug within the kernel system, if it exists there.

Hi,

Can you please let know the process of filing kernel bug please ?

https://bugzilla.kernel.org/
Register and fill in an entry. They will want a reproducible way to get the bug.

If you want to partake in correspondence about it, join the Linux Kernel Mailing List and get 500-600 mails per day on kernel matters.

Sure I do that
Thank you.

Thanks again. I reported this bug in official Kernel bugzee: https://bugzilla.kernel.org/show_bug.cgi?id=79091

cheers, Kiran

I had a quick look. It's your bug. The rules of this are: He writes the patch, based on the information you have to supply to him; you have to test it.

Download the source and get ready for the patch, because when the patch comes they'll want you to try it. If you're on an RHEL clone(Fedora, Centos, Sciantific Linux, RHEL, etc), do one other thing: Download the source from the distro (which will include a bundle of patches they stick onto the kernel) and make sure _they_ are not patching the same module.

I would also upload, if you can, a test packet and it's corrupted and correct output.

Yes looks like now they patched the 3.15.2. I was in touch with Greg and Don offline (who are doing something about it as referred in Changelogs).

Shortly I test once 3.15.2 and find weather this solves the issue.

In Phoronix there is an article published couple of days ago:
Titled: LZO & LZ4 Security Vulnerabilities Disclosed
http://www.phoronix.com/scan.php?pag...tem&px=MTczMTQ

And as well this points to mailing list:
http://www.openwall.com/lists/oss-se.../2014/06/26/25
http://www.openwall.com/lists/oss-se.../2014/06/26/20

This is an attempt by a security company to grab some undue fame by blowing out of proportion an already known vulnerability.
They are basically surfing on the "heartbleed" wave.
Not only was the vulnerability known way before the security firm "disclosed" it, but it was also known to be inaccessible, hence impossible to trigger an attack with it with currently known implementations.
Nonetheless, it was tracked as an issue to solve, and patched, "just in case" future implementations get outside of the secured specification format.

---------- Post added 06-29-14 at 09:42 AM ----------

For more info on it :
http://fastcompression.blogspot.fr/2...s-move-on.html

Serticall,

I 100% agree your point

Since even I am wondering how on earth a compression issue could relate to security issue ?

Kernel guys although classified these compression libraries/modules under cryto category. But there is nothing about security in it.

Good that you pointed out. May be sometimes they think people lack some commen sense -> and project as security vulnerability !