Re: [PATCH 1/3] bootm: size the noload decompression buffer from the compressor header

On Sun, Aug 09, 2026 at 04:23:27AM +0000, Aristo Chen wrote:

> For a compressed kernel_noload image, bootm_load_os() allocates a
> per-image decompression buffer of ALIGN(image_len * 8, SZ_1M). The 8x
> multiplier is a heuristic: it comfortably covers what zstd and xz
> achieve on real kernels, but any well-compressed payload (say, a big
> run of zeros) can exceed it and fail decompression, and no fixed
> multiplier is safe against arbitrarily compressible input.
> 
> Read the real uncompressed size from the compressor header instead.
> Add a small helper image_decomp_get_uncompressed_size() that returns
> the uncompressed size when the format carries one: gzip ISIZE, lzma
> header uncompressed size, lz4 frame Content_Size when the FLG bit is
> set, and zstd Frame_Content_Size. Other formats return -EOPNOTSUPP.
> Bootm uses it to size the buffer to ALIGN(hdr_size, SZ_1M), capped at
> CONFIG_SYS_BOOTM_LEN because the value is attacker-controlled, and
> falls back to the 8x heuristic for formats without a size field
> (bzip2, lzo, xz) or when the header lacks the size (some lzma or lz4
> streams).

Have we gotten actual problem reports? This is a good bit of growth for
a problem I'm not sure we're seeing. Thanks.

-- 
Tom

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTzzqh0PWDgGS+bTHor4qD1Cr/kCgUCanicRAAKCRAr4qD1Cr/k
CnmsAP9g/qfbwVtN+xmtBcCpJoNuCryHiFEO//sUFNzM18cA2QD/bDAP9ZGiZC7J
Czh6NzGSc4yp/2b9ok0G9bceLEWE5Q0=
=CMAX
-----END PGP SIGNATURE-----