ANDROID: dm: android-verity: Verify header before fetching table
Move header validation logic before reading the verity_table as
an invalid header implies the table is invalid as well.
(Cherry-picked from:
https://partner-android-review.git.corp.google.com/#/c/625203)
BUG: 29940612
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: Ib34d25c0854202f3e70df0a6d0ef1d96f0250c8e
diff --git a/drivers/md/dm-android-verity.c b/drivers/md/dm-android-verity.c
index 999e75b..1f4eb09 100644
--- a/drivers/md/dm-android-verity.c
+++ b/drivers/md/dm-android-verity.c
@@ -365,12 +365,38 @@
return 0;
}
-static struct android_metadata *extract_metadata(dev_t dev,
- struct fec_header *fec)
+static int verify_header(struct android_metadata_header *header)
+{
+ int retval = -EINVAL;
+
+ if (is_userdebug() && le32_to_cpu(header->magic_number) ==
+ VERITY_METADATA_MAGIC_DISABLE)
+ return VERITY_STATE_DISABLE;
+
+ if (!(le32_to_cpu(header->magic_number) ==
+ VERITY_METADATA_MAGIC_NUMBER) ||
+ (le32_to_cpu(header->magic_number) ==
+ VERITY_METADATA_MAGIC_DISABLE)) {
+ DMERR("Incorrect magic number");
+ return retval;
+ }
+
+ if (le32_to_cpu(header->protocol_version) !=
+ VERITY_METADATA_VERSION) {
+ DMERR("Unsupported version %u",
+ le32_to_cpu(header->protocol_version));
+ return retval;
+ }
+
+ return 0;
+}
+
+static int extract_metadata(dev_t dev, struct fec_header *fec,
+ struct android_metadata **metadata,
+ bool *verity_enabled)
{
struct block_device *bdev;
struct android_metadata_header *header;
- struct android_metadata *uninitialized_var(metadata);
int i;
u32 table_length, copy_length, offset;
u64 metadata_offset;
@@ -381,7 +407,7 @@
if (IS_ERR_OR_NULL(bdev)) {
DMERR("blkdev_get_by_dev failed");
- return ERR_CAST(bdev);
+ return -ENODEV;
}
find_metadata_offset(fec, bdev, &metadata_offset);
@@ -399,7 +425,6 @@
(1 << SECTOR_SHIFT), VERITY_METADATA_SIZE);
if (err) {
DMERR("Error while reading verity metadata");
- metadata = ERR_PTR(err);
goto blkdev_release;
}
@@ -418,24 +443,42 @@
le32_to_cpu(header->protocol_version),
le32_to_cpu(header->table_length));
- metadata = kzalloc(sizeof(*metadata), GFP_KERNEL);
- if (!metadata) {
+ err = verify_header(header);
+
+ if (err == VERITY_STATE_DISABLE) {
+ DMERR("Mounting root with verity disabled");
+ *verity_enabled = false;
+ /* we would still have to read the metadata to figure out
+ * the data blocks size. Or may be could map the entire
+ * partition similar to mounting the device.
+ *
+ * Reset error as well as the verity_enabled flag is changed.
+ */
+ err = 0;
+ } else if (err)
+ goto free_header;
+
+ *metadata = kzalloc(sizeof(**metadata), GFP_KERNEL);
+ if (!*metadata) {
DMERR("kzalloc for metadata failed");
err = -ENOMEM;
goto free_header;
}
- metadata->header = header;
+ (*metadata)->header = header;
table_length = le32_to_cpu(header->table_length);
if (table_length == 0 ||
table_length > (VERITY_METADATA_SIZE -
- sizeof(struct android_metadata_header)))
+ sizeof(struct android_metadata_header))) {
+ DMERR("table_length too long");
+ err = -EINVAL;
goto free_metadata;
+ }
- metadata->verity_table = kzalloc(table_length + 1, GFP_KERNEL);
+ (*metadata)->verity_table = kzalloc(table_length + 1, GFP_KERNEL);
- if (!metadata->verity_table) {
+ if (!(*metadata)->verity_table) {
DMERR("kzalloc verity_table failed");
err = -ENOMEM;
goto free_metadata;
@@ -443,13 +486,15 @@
if (sizeof(struct android_metadata_header) +
table_length <= PAGE_SIZE) {
- memcpy(metadata->verity_table, page_address(payload.page_io[0])
+ memcpy((*metadata)->verity_table,
+ page_address(payload.page_io[0])
+ sizeof(struct android_metadata_header),
table_length);
} else {
copy_length = PAGE_SIZE -
sizeof(struct android_metadata_header);
- memcpy(metadata->verity_table, page_address(payload.page_io[0])
+ memcpy((*metadata)->verity_table,
+ page_address(payload.page_io[0])
+ sizeof(struct android_metadata_header),
copy_length);
table_length -= copy_length;
@@ -457,13 +502,13 @@
i = 1;
while (table_length != 0) {
if (table_length > PAGE_SIZE) {
- memcpy(metadata->verity_table + offset,
+ memcpy((*metadata)->verity_table + offset,
page_address(payload.page_io[i]),
PAGE_SIZE);
offset += PAGE_SIZE;
table_length -= PAGE_SIZE;
} else {
- memcpy(metadata->verity_table + offset,
+ memcpy((*metadata)->verity_table + offset,
page_address(payload.page_io[i]),
table_length);
table_length = 0;
@@ -471,25 +516,23 @@
i++;
}
}
- metadata->verity_table[table_length] = '\0';
+ (*metadata)->verity_table[table_length] = '\0';
+ DMINFO("verity_table: %s", (*metadata)->verity_table);
goto free_payload;
free_metadata:
- kfree(metadata);
+ kfree(*metadata);
free_header:
kfree(header);
- metadata = ERR_PTR(err);
free_payload:
for (i = 0; i < payload.number_of_pages; i++)
if (payload.page_io[i])
__free_page(payload.page_io[i]);
kfree(payload.page_io);
-
- DMINFO("verity_table: %s", metadata->verity_table);
blkdev_release:
blkdev_put(bdev, FMODE_READ);
- return metadata;
+ return err;
}
/* helper functions to extract properties from dts */
@@ -522,34 +565,6 @@
return DM_VERITY_MODE_EIO;
}
-static int verify_header(struct android_metadata_header *header)
-{
- int retval = -EINVAL;
-
- if (is_userdebug() && le32_to_cpu(header->magic_number) ==
- VERITY_METADATA_MAGIC_DISABLE) {
- retval = VERITY_STATE_DISABLE;
- return retval;
- }
-
- if (!(le32_to_cpu(header->magic_number) ==
- VERITY_METADATA_MAGIC_NUMBER) ||
- (le32_to_cpu(header->magic_number) ==
- VERITY_METADATA_MAGIC_DISABLE)) {
- DMERR("Incorrect magic number");
- return retval;
- }
-
- if (le32_to_cpu(header->protocol_version) !=
- VERITY_METADATA_VERSION) {
- DMERR("Unsupported version %u",
- le32_to_cpu(header->protocol_version));
- return retval;
- }
-
- return 0;
-}
-
static int verify_verity_signature(char *key_id,
struct android_metadata *metadata)
{
@@ -649,7 +664,7 @@
static int android_verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
{
dev_t uninitialized_var(dev);
- struct android_metadata *uninitialized_var(metadata);
+ struct android_metadata *metadata = NULL;
int err = 0, i, mode;
char *key_id, *table_ptr, dummy, *target_device,
*verity_table_args[VERITY_TABLE_ARGS + 2 + VERITY_TABLE_OPT_FEC_ARGS];
@@ -717,26 +732,11 @@
return -EINVAL;
}
- metadata = extract_metadata(dev, &fec);
+ err = extract_metadata(dev, &fec, &metadata, &verity_enabled);
- if (IS_ERR(metadata)) {
+ if (err) {
DMERR("Error while extracting metadata");
handle_error();
- return -EINVAL;
- }
-
- err = verify_header(metadata->header);
-
- if (err == VERITY_STATE_DISABLE) {
- DMERR("Mounting root with verity disabled");
- verity_enabled = false;
- /* we would still have to parse the args to figure out
- * the data blocks size. Or may be could map the entire
- * partition similar to mounting the device.
- */
- } else if (err) {
- DMERR("Verity header handle error");
- handle_error();
goto free_metadata;
}
@@ -869,8 +869,10 @@
}
free_metadata:
- kfree(metadata->header);
- kfree(metadata->verity_table);
+ if (metadata) {
+ kfree(metadata->header);
+ kfree(metadata->verity_table);
+ }
kfree(metadata);
return err;
}