Skip to content

Commit

Permalink
fsmgr: fix integer overflow in fs_mgr
Browse files Browse the repository at this point in the history
As the EXT4_MAX_BLOCK_SIZE defined as 65536 which reached maxium value
of unsigned int. The superblock value maybe larger than 65536. This is
found by the Integer Overflow Sanitizer.

This patch fixed below boot error when userdata is corrupted:
init: processing action (fs) from
(/vendor/etc/init/hw/init.freescale.rc:221)
init: [libfs_mgr]Invalid ext4 superblock on '/dev/block/by-name/userdata'
init: InitFatalReboot: signal 6 init: #00 pc 00000000000af7e8  /system/bin/init
(android::init::InitFatalReboot(int)+208) init: #1 pc 00000000000afbd0  /system/bin/init
(android::init::InstallRebootSignalHandlers()::$_22::__invoke(int)+32)
init: aosp-mirror#2 pc 00000000000006bc  [vdso:0000ffff9691b000] (__kernel_rt_sigreturn)
init: aosp-mirror#3 pc 000000000004e070  /system/lib64/bootstrap/libc.so (abort+176)
init: aosp-mirror#4 pc 000000000003427c  /system/lib64/libfs_mgr.so
(read_ext4_superblock(std::__1::basic_string<char, std::__1::char_
traits<char>, std::__1::allocator<char> > const&,
android::fs_mgr::FstabEntry const&, ext4_super_block*, int*)+1804)

Test: boot with corrupted ext4 superblock

Change-Id: I58ed723afa9975d0e93f96fad7c55465e68b3edd
Signed-off-by: Haoran.Wang <[email protected]>

Former-commit-id: 4a48945
  • Loading branch information
TE-N-ElvenWang committed Jun 16, 2020
1 parent a62d37d commit 0afd364
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion fs_mgr/fs_mgr.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ static bool read_ext4_superblock(const std::string& blk_device, const FstabEntry
// try backup superblock, if main superblock is corrupted
for (unsigned int blocksize = EXT4_MIN_BLOCK_SIZE; blocksize <= EXT4_MAX_BLOCK_SIZE;
blocksize *= 2) {
unsigned int superblock = blocksize * 8;
uint64_t superblock = blocksize * 8;
if (blocksize == EXT4_MIN_BLOCK_SIZE) superblock++;

if (TEMP_FAILURE_RETRY(pread(fd, sb, sizeof(*sb), superblock * blocksize)) !=
Expand Down

0 comments on commit 0afd364

Please sign in to comment.