Hi,
I had some time today to check the status of this. I'm hoping everything
can at least be sorted for the Forky release. GRUB 2.14 now includes the
zstdio module I sent upstream, but Xen PV guests still can't boot
Trixie's zstd-compressed kernels with 2.14-4, for two reasons:
1. debian/patches/insmod-xzio-and-lzopio-on-xen.patch only loads xzio
and lzopio on Xen, so grub.cfg never loads zstdio and the kernel still
fails with "not xen image".
2. My original zstdio patch has a heap overrun. grub_zstdio_open() sizes
its allocation with sizeof(zstdio_t) instead of the struct itself, so
decompression writes 80 bytes past the end of the buffer. Whether that
crashes depends on the heap layout: on one of my guests, loading zstdio
earlier made GRUB abort with "alloc magic is broken" while loading the
initrd.
I've sent the fix to grub-devel as "[PATCH] io/zstdio: Fix heap overrun
of the decompression buffers" (GNU's servers are currently down, so it
may take a while to appear in the archive).
Attached are two patches:
0001 backports the overrun fix to debian/patches/upstream/
0002 adds insmod zstdio to the Xen line in
insmod-xzio-and-lzopio-on-xen.patch
Please don't apply 0002 without 0001, or it just enables the overrun for
everyone.
I've also replaced the Trixie packages at
https://staff.deltatee.com/~logang/grub/ with 2.12-9.4, which includes
the fix. Anyone using my earlier builds should probably upgrade lest a
change causes the system to no longer boot.
Fixing Trixie would need the zstdio backport, the overrun fix and the
insmod change together.
Thanks,
Logan
From 63613d2b3027e6510cd5092a7a60dcc9234bc802 Mon Sep 17 00:00:00 2001
From: Logan Gunthorpe <[email protected]>
Date: Tue, 6 Oct 2026 11:28:44 -0600
Subject: [PATCH 2/2] Also insmod zstdio when booting a Xen guest
Trixie kernels are built with CONFIG_KERNEL_ZSTD. The Xen loader needs
the kernel decompressed, and since 2.14 GRUB has zstdio, but grub.cfg
only loads xzio and lzopio on Xen. PV guests still fail with "not xen
image" (Closes: #1102066).
---
debian/changelog | 2 ++
debian/patches/insmod-xzio-and-lzopio-on-xen.patch | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/debian/changelog b/debian/changelog
index 8a236e0b323f..2994e235b5c2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ grub2 (2.14-5) UNRELEASED; urgency=medium
[ Logan Gunthorpe ]
* Backport fix for a heap overrun in zstdio
+ * Also insmod zstdio on Xen so Trixie's zstd-compressed kernels boot
+ as PV guests (Closes: #1102066)
-- Logan Gunthorpe <[email protected]> Tue, 06 Oct 2026 11:28:34 -0600
diff --git a/debian/patches/insmod-xzio-and-lzopio-on-xen.patch b/debian/patches/insmod-xzio-and-lzopio-on-xen.patch
index ad82af06bb34..8de36c3119a3 100644
--- a/debian/patches/insmod-xzio-and-lzopio-on-xen.patch
+++ b/debian/patches/insmod-xzio-and-lzopio-on-xen.patch
@@ -26,7 +26,7 @@ index 90ad4e1..24e015d 100644
fi
echo " insmod gzio" | sed "s/^/$submenu_indentation/"
-+ echo " if [ x\$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi" | sed "s/^/$submenu_indentation/"
++ echo " if [ x\$grub_platform = xxen ]; then insmod xzio; insmod lzopio; insmod zstdio; fi" | sed "s/^/$submenu_indentation/"
if [ x$dirname = x/ ]; then
if [ -z "${prepare_root_cache}" ]; then
--
2.47.3
From 0b3c03589f877becdf03fd12ea2c962a3a62c0bd Mon Sep 17 00:00:00 2001
From: Logan Gunthorpe <[email protected]>
Date: Tue, 6 Oct 2026 13:38:04 -0600
Subject: [PATCH 1/2] Backport fix for a heap overrun in zstdio
zstdio sizes its buffer allocation with the size of a pointer rather
than of struct zstdio, so decompressing writes 80 bytes past the end of
the allocation. Booting a zstd-compressed kernel on Xen can then abort
with "alloc magic is broken".
---
debian/changelog | 7 ++++
debian/patches/series | 1 +
...ap-overrun-of-the-decompression-buff.patch | 38 +++++++++++++++++++
3 files changed, 46 insertions(+)
create mode 100644 debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch
diff --git a/debian/changelog b/debian/changelog
index a195a1177851..8a236e0b323f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+grub2 (2.14-5) UNRELEASED; urgency=medium
+
+ [ Logan Gunthorpe ]
+ * Backport fix for a heap overrun in zstdio
+
+ -- Logan Gunthorpe <[email protected]> Tue, 06 Oct 2026 11:28:34 -0600
+
grub2 (2.14-4) unstable; urgency=medium
[ Trupti Shirsat ]
diff --git a/debian/patches/series b/debian/patches/series
index 60a5ea3d2570..7be76c089082 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -77,3 +77,4 @@ upstream/fix-for-gcc-2.16-2.patch
upstream/fix-for-gcc-2.16-3.patch
upstream/fix-for-gcc-2.16-4.patch
upstream/efi-sb-Fix-boot-failure-when-shim-validation-is-disa.patch
+upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch
diff --git a/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch b/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch
new file mode 100644
index 000000000000..7b5eb83c47c1
--- /dev/null
+++ b/debian/patches/upstream/io-zstdio-Fix-heap-overrun-of-the-decompression-buff.patch
@@ -0,0 +1,38 @@
+From 1ad657b740ab302c9c204ef6ec52db9c748b9e21 Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <[email protected]>
+Date: Tue, 6 Oct 2026 12:00:13 -0600
+Subject: [PATCH] io/zstdio: Fix heap overrun of the decompression buffers
+
+grub_zstdio_open() sizes its allocation with sizeof (zstdio_t), which is
+the pointer typedef rather than struct zstdio. The buffers in bufs[]
+therefore start sizeof (struct zstdio) - sizeof (zstdio_t) bytes (80 on
+x86_64) further into the allocation than it allows for, and every full
+output chunk writes that many bytes past its end.
+
+On a Xen PV guest booting a zstd-compressed kernel this corrupts the heap
+and GRUB aborts with "alloc magic is broken" while loading the initrd.
+(Though, this may depend on what happens to follow the allocation.)
+
+Fixes: 8ea83c3ee (io/zstdio: Implement zstdio decompression)
+Signed-off-by: Logan Gunthorpe <[email protected]>
+
+---
+ grub-core/io/zstdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/io/zstdio.c b/grub-core/io/zstdio.c
+index 379eba0c6e00..c3807379097a 100644
+--- a/grub-core/io/zstdio.c
++++ b/grub-core/io/zstdio.c
+@@ -81,7 +81,7 @@ grub_zstdio_open (grub_file_t io, enum grub_file_type type)
+ if (file == NULL)
+ return NULL;
+
+- zstdio = grub_zalloc (sizeof (zstdio_t) + ZSTD_DStreamInSize () +
++ zstdio = grub_zalloc (sizeof (*zstdio) + ZSTD_DStreamInSize () +
+ ZSTD_DStreamOutSize ());
+ if (zstdio == NULL)
+ {
+--
+2.47.3
+
--
2.47.3
