[U-Boot] [PATCH 7/7] common: avb_verify: Fix division by zero in mmc_byte_io()

[Igor Opaniuk]

Thanks for fixing this!

Reviewed-by: Igor Opaniuk <igor.opaniuk at linaro.org>

On 14 August 2018 at 03:43, Eugeniu Rosca <roscaeugeniu at gmail.com> wrote:
> Compiling U-Boot with ubsan/asan libraries and running it in sandbox
> may lead to below backtrace:
>
>  => avb init 0
>  => avb verify
>  ## Android Verified Boot 2.0 version 1.1.0
> read_is_device_unlocked not supported yet
> common/avb_verify.c:407:31: runtime error: division by zero
> AddressSanitizer:DEADLYSIGNAL
> =================================================================
> ==9388==ERROR: AddressSanitizer: FPE on unknown address 0x0000004b467f \
>     (pc 0x0000004b467f bp 0x000000000000 sp 0x7ffd899fe150 T0)
>     #0 0x4b467e in mmc_byte_io common/avb_verify.c:407
>     #1 0x4b4c47 in mmc_byte_io common/avb_verify.c:532
>     #2 0x4b4c47 in read_from_partition common/avb_verify.c:533
>     #3 0x69dc0d in load_and_verify_vbmeta lib/libavb/avb_slot_verify.c:560
>     #4 0x6a1ee6 in avb_slot_verify lib/libavb/avb_slot_verify.c:1139
>     #5 0x45dabd in do_avb_verify_part cmd/avb.c:245
>     #6 0x4af77c in cmd_call common/command.c:499
>     #7 0x4af77c in cmd_process common/command.c:538
>     #8 0x46bafc in run_pipe_real common/cli_hush.c:1677
>     #9 0x46bafc in run_list_real common/cli_hush.c:1875
>     #10 0x46c780 in run_list common/cli_hush.c:2024
>     #11 0x46c780 in parse_stream_outer common/cli_hush.c:3216
>     #12 0x46d34b in parse_file_outer common/cli_hush.c:3299
>     #13 0x4ad609 in cli_loop common/cli.c:217
>     #14 0x4625ae in main_loop common/main.c:65
>     #15 0x46f2d1 in run_main_loop common/board_r.c:648
>     #16 0x640253 in initcall_run_list lib/initcall.c:30
>     #17 0x46f9d0 in board_init_r common/board_r.c:879
>     #18 0x40539b in main arch/sandbox/cpu/start.c:321
>     #19 0x7fa94925f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
>     #20 0x408908 in _start (/srv/R/u-boot-master/u-boot+0x408908)
>
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: FPE common/avb_verify.c:407 in mmc_byte_io
> ==9388==ABORTING
>
> Signed-off-by: Eugeniu Rosca <erosca at de.adit-jv.com>
> ---
>  common/avb_verify.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/common/avb_verify.c b/common/avb_verify.c
> index 3d2b4cbad92d..759df7bd25c0 100644
> --- a/common/avb_verify.c
> +++ b/common/avb_verify.c
> @@ -402,6 +402,9 @@ static AvbIOResult mmc_byte_io(AvbOps *ops,
>         if (!part)
>                 return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
>
> +       if (!part->info.blksz)
> +               return AVB_IO_RESULT_ERROR_IO;
> +
>         start_offset = calc_offset(part, offset);
>         while (num_bytes) {
>                 start_sector = start_offset / part->info.blksz;
> --
> 2.18.0
>



-- 
Regards,
Igor Opaniuk