Skip to content

Commit

Permalink
fsmgr: fix integer overflow in fs_mgr
Browse files Browse the repository at this point in the history
As the EXT4_MAX_BLOCK_SIZE defined as 65536 which reached maxium value
of unsigned int. The superblock value maybe larger than 65536. This is
found by the Integer Overflow Sanitizer.

This patch fixed below boot error when userdata is corrupted:
init: processing action (fs) from
(/vendor/etc/init/hw/init.freescale.rc:221)
init: [libfs_mgr]Invalid ext4 superblock on '/dev/block/by-name/userdata'
init: InitFatalReboot: signal 6 init: #00 pc 00000000000af7e8  /system/bin/init
(android::init::InitFatalReboot(int)+208) init: #01 pc 00000000000afbd0  /system/bin/init
(android::init::InstallRebootSignalHandlers()::$_22::__invoke(int)+32)
init: #02 pc 00000000000006bc  [vdso:0000ffff9691b000] (__kernel_rt_sigreturn)
init: #03 pc 000000000004e070  /system/lib64/bootstrap/libc.so (abort+176)
init: #04 pc 000000000003427c  /system/lib64/libfs_mgr.so
(read_ext4_superblock(std::__1::basic_string<char, std::__1::char_
traits<char>, std::__1::allocator<char> > const&,
android::fs_mgr::FstabEntry const&, ext4_super_block*, int*)+1804)

Test: boot with corrupted ext4 superblock
Bug: 156200421

Signed-off-by: Haoran.Wang <elven.wang@nxp.com>
Change-Id: Ib1b69bf4623f69696cb637b226ec3359fc2ed409
(cherry picked from commit cb472b92e54ba1647c02397565958322f0d74929)

Former-commit-id: e28dc48de52af3e216fb3a85df382f3643b39496
  • Loading branch information
Tom Cherry authored and Randall Huang committed Jun 16, 2020
1 parent cf53c54 commit 562efd3
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion fs_mgr/fs_mgr.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ static bool read_ext4_superblock(const std::string& blk_device, const FstabEntry
// try backup superblock, if main superblock is corrupted
for (unsigned int blocksize = EXT4_MIN_BLOCK_SIZE; blocksize <= EXT4_MAX_BLOCK_SIZE;
blocksize *= 2) {
unsigned int superblock = blocksize * 8;
uint64_t superblock = blocksize * 8;
if (blocksize == EXT4_MIN_BLOCK_SIZE) superblock++;

if (TEMP_FAILURE_RETRY(pread(fd, sb, sizeof(*sb), superblock * blocksize)) !=
Expand Down

0 comments on commit 562efd3

Please sign in to comment.