CVE-2024-57923

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path

Since the input data length passed to zlib_compress_folios() can be

arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may

cause read-in bytes to exceed the input range. Currently this triggers

an assert in btrfs_compress_folios() on the debug kernel (see below).

Fix strm.avail_in calculation for S390 hardware acceleration path.

assertion failed: *total_in <= orig_len, in fs/btrfs/compression.c:1041

------------[ cut here ]------------

kernel BUG at fs/btrfs/compression.c:1041!

monitor event: 0040 ilc:2 [#1] PREEMPT SMP

CPU: 16 UID: 0 PID: 325 Comm: kworker/u273:3 Not tainted 6.13.0-20241204.rc1.git6.fae3b21430ca.300.fc41.s390x+debug #1

Hardware name: IBM 3931 A01 703 (z/VM 7.4.0)

Workqueue: btrfs-delalloc btrfs_work_helper

Krnl PSW : 0704d00180000000 0000021761df6538 (btrfs_compress_folios+0x198/0x1a0)

R:0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References