On Tue, Oct 6, 2026 at 3:34 PM Logan Gunthorpe via Grub-devel <[email protected]> wrote: > > grub_zstdio_open() sizes its allocation with sizeof (zstdio_t), which is > the pointer typedef rather than struct zstdio. The buffers in bufs[] > therefore start sizeof (struct zstdio) - sizeof (zstdio_t) bytes (80 on > x86_64) further into the allocation than it allows for, and every full > output chunk writes that many bytes past its end. > > On a Xen PV guest booting a zstd-compressed kernel this corrupts the heap > and GRUB aborts with "alloc magic is broken" while loading the initrd. > (Though, this may depend on what happens to follow the allocation.) > > Fixes: 8ea83c3ee (io/zstdio: Implement zstdio decompression) > Signed-off-by: Logan Gunthorpe <[email protected]>
GRUB development has moved to freedesktop.org. Please submit patches there. https://gitlab.freedesktop.org/gnu-grub/grub/ _______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
