• Alexandre Courbot's avatar
    lib/decompressors: fix "no limit" output buffer length · 1431574a
    Alexandre Courbot authored
    When decompressing into memory, the output buffer length is set to some
    arbitrarily high value (0x7fffffff) to indicate the output is, virtually,
    unlimited in size.
    
    The problem with this is that some platforms have their physical memory at
    high physical addresses (0x80000000 or more), and that the output buffer
    address and its "unlimited" length cannot be added without overflowing.
    An example of this can be found in inflate_fast():
    
    /* next_out is the output buffer address */
    out = strm->next_out - OFF;
    /* avail_out is the output buffer size. end will overflow if the output
     * address is >= 0x80000104 */
    end = out + (strm->avail_out - 257);
    
    This has huge consequences on the performance of kernel decompression,
    since the following exit condition of inflate_fast() will be always true:
    
    } while (in < last && out < end);
    
    Indeed, "end" has overflowed and is now always lower than "out".  As a
    result, inflate_fast() will return after processing one single byte of
    input data, and will thus need to be called an unreasonably high number of
    times.  This probably went unnoticed because kernel decompression is fast
    enough even with this issue.
    
    Nonetheless, adjusting the output buffer length in such a way that the
    above pointer arithmetic never overflows results in a kernel decompression
    that is about 3 times faster on affected machines.
    Signed-off-by: default avatarAlexandre Courbot <acourbot@nvidia.com>
    Tested-by: default avatarJon Medhurst <tixy@linaro.org>
    Cc: Stephen Warren <swarren@wwwdotorg.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    1431574a
decompress_inflate.c 3.74 KB