Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data length passed to zlib_compress_folios() can be arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may cause read-in bytes to exceed the input range. Currently this triggers an assert in btrfs_compress_folios() on the debug kernel (see below). Fix strm.avail_in calculation for S390 hardware acceleration path. assertion failed: *total_in 0000021761df6538: 0707 bcr 0,%r7 0000021761df653a: 0707 bcr 0,%r7 0000021761df653c: 0707 bcr 0,%r7 0000021761df653e: 0707 bcr 0,%r7 0000021761df6540: c004004bb7ec brcl 0,000002176276d518 Call Trace: [] btrfs_compress_folios+0x198/0x1a0 ([] btrfs_compress_folios+0x194/0x1a0) [] compress_file_range+0x3b8/0x6d0 [] btrfs_work_helper+0x10c/0x160 [] process_one_work+0x2b0/0x5d0 [] worker_thread+0x20e/0x3e0 [] kthread+0x15a/0x170 [] __ret_from_fork+0x3c/0x60 [] ret_from_fork+0xa/0x38 INFO: lockdep is turned off. Last Breaking-Event-Address: [] _printk+0x4c/0x58 Kernel panic - not syncing: Fatal exception: panic_on_oops