ANDROID: dm verity fec: limit error correction recursion
authorSami Tolvanen <samitolvanen@google.com>
Fri, 3 Jun 2016 21:06:14 +0000 (14:06 -0700)
committerAmit Pundir <amit.pundir@linaro.org>
Thu, 16 Jun 2016 08:14:10 +0000 (13:44 +0530)
commit69c5db92e4726042c3b4bb6a336fb2bce0995e52
tree817a532bd1e567ef296811400a08bd779c52566e
parent377fd8e3af2c1f74b51817032fcbe6c06e49ea7e
ANDROID: dm verity fec: limit error correction recursion

If verity tree itself is sufficiently corrupted in addition to data
blocks, it's possible for error correction to end up in a deep recursive
error correction loop that eventually causes a kernel panic as follows:

[   14.728962] [<ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138
[   14.734691] [<ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180
[   14.740681] [<ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0
[   14.746671] [<ffffffc0008c1508>] fec_decode_rsb+0x318/0x75c
[   14.752226] [<ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138
[   14.757956] [<ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180
[   14.763944] [<ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0

This change limits the recursion to a reasonable level during a single
I/O operation.

Bug: 28943429
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: I0a7ebff331d259c59a5e03c81918cc1613c3a766
(cherry picked from commit f4b9e40597e73942d2286a73463c55f26f61bfa7)
drivers/md/dm-verity-fec.c
drivers/md/dm-verity-fec.h