CVE-2024-57923 – btrfs zlib S390 Hardware Acceleration Path Buffer Overflow

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path

Since the input data length passed to zlib_compress_folios() can be
arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may
cause read-in bytes to exceed the input range. Currently this triggers
an assert in btrfs_compress_folios() on the debug kernel (see below).
Fix strm.avail_in calculation for S390 hardware acceleration path.

assertion failed: *total_in 0000021761df6538: 0707 bcr 0,%r7
0000021761df653a: 0707 bcr 0,%r7
0000021761df653c: 0707 bcr 0,%r7
0000021761df653e: 0707 bcr 0,%r7
0000021761df6540: c004004bb7ec brcl 0,000002176276d518
Call Trace:
[] btrfs_compress_folios+0x198/0x1a0
([] btrfs_compress_folios+0x194/0x1a0)
[] compress_file_range+0x3b8/0x6d0
[] btrfs_work_helper+0x10c/0x160
[] process_one_work+0x2b0/0x5d0
[] worker_thread+0x20e/0x3e0
[] kthread+0x15a/0x170
[] __ret_from_fork+0x3c/0x60
[] ret_from_fork+0xa/0x38
INFO: lockdep is turned off.
Last Breaking-Event-Address:
[] _printk+0x4c/0x58
Kernel panic – not syncing: Fatal exception: panic_on_oops