search

GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
364 stars 21 forks source link

`SIGSEGV faultAddr` in system_server `libandroidfw.so` #4077

Open Rot127 opened 1 month ago

Rot127 commented 1 month ago

I randomly found a crash report in the owner profile. Unfortunately, I don't have any hint what might have triggered it.

Sorry, I know it is the worst debug situation possible.

type: crash
osVersion: google/panther/panther:14/AP2A.240905.003/2024091900:user/release-keys
uid: 1000 (u:r:system_server:s0)
cmdline: system_server
processUptime: 280869s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr be019e344990
threadName: shortcut

backtrace:
    /system/lib64/libandroidfw.so (android::AssetManager2::FindEntryInternal(android::AssetManager2::PackageGroup const&, unsigned char, unsigned short, android::ResTable_config const&, bool, bool) const+552, pc 8ebf8)
    /system/lib64/libandroidfw.so (android::AssetManager2::FindEntry(unsigned int, unsigned short, bool, bool) const+584, pc 8df28)
    /system/lib64/libandroidfw.so (android::AssetManager2::GetResource(unsigned int, bool, unsigned short) const+96, pc 8fcd0)
    /system/lib64/libandroid_runtime.so (android::NativeGetResourceValue(_JNIEnv*, _jclass*, long, int, short, _jobject*, unsigned char)+164, pc 196ae4)
    /system/framework/arm64/boot-framework.oat (art_jni_trampoline+136, pc 1dc968)
    /system/framework/arm64/boot-framework.oat (android.content.res.AssetManager.getResourceValue+152, pc 263128)
    /system/framework/arm64/boot-framework.oat (android.content.res.Resources.getText+124, pc 26c09c)
    /system/framework/arm64/boot-framework.oat (android.content.res.Resources.getString+40, pc 26bd28)
    /apex/com.android.art/lib64/libart.so (nterp_helper+4016, pc 6c2070)
    /system/framework/framework.jar (android.content.pm.ShortcutInfo.getResourceString+0, pc 3b4d40)
    /apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6c2014)
    /system/framework/framework.jar (android.content.pm.ShortcutInfo.resolveResourceStrings+54, pc 3b6672)
    /apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6c2014)
    /system/framework/services.jar (com.android.server.pm.ShortcutPackage.lambda$resolveResourceStrings$24+14, pc 338952)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutPackage.$r8$lambda$4fqCQ9kOhUygaEQRFY3uQqAltjM+0, pc 337060)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutPackage$$ExternalSyntheticLambda34.accept+16, pc 33352c)
    /system/framework/oat/arm64/services.odex (com.android.server.pm.ShortcutPackage.forEachShortcutMutate+188, pc 5eb4fc)
    /apex/com.android.art/lib64/libart.so (nterp_helper+4016, pc 6c2070)
    /system/framework/services.jar (com.android.server.pm.ShortcutPackage.resolveResourceStrings+42, pc 339356)
    /apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6c2014)
    /system/framework/services.jar (com.android.server.pm.ShortcutUser.lambda$detectLocaleChange$1+6, pc 345dc2)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutUser.$r8$lambda$In82QhJ-Sku78LsVH3sI9Fds4BA+0, pc 345728)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutUser$$ExternalSyntheticLambda0.accept+4, pc 344f84)
    /system/framework/oat/arm64/services.odex (com.android.server.pm.ShortcutUser.forAllPackages+164, pc 514b24)
    /system/framework/oat/arm64/services.odex (com.android.server.pm.ShortcutUser.detectLocaleChange+244, pc 514a34)
    /apex/com.android.art/lib64/libart.so (nterp_helper+4016, pc 6c2070)
    /system/framework/services.jar (com.android.server.pm.ShortcutService.lambda$handleLocaleChanged$13+0, pc 34363c)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutService.$r8$lambda$IoL_G5_KwdQvp9KXUZYf4p8p0fk+0, pc 3417a4)
    /apex/com.android.art/lib64/libart.so (nterp_helper+52, pc 6c10f4)
    /system/framework/services.jar (com.android.server.pm.ShortcutService$$ExternalSyntheticLambda29.accept+4, pc 33b624)
    /apex/com.android.art/lib64/libart.so (nterp_helper+7540, pc 6c2e34)
    /system/framework/services.jar (com.android.server.pm.ShortcutService.forEachLoadedUserLocked+36, pc 342eb8)
    /apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6c2014)
    /system/framework/services.jar (com.android.server.pm.ShortcutService.handleLocaleChanged+30, pc 342f4e)
    /apex/com.android.art/lib64/libart.so (nterp_helper+3924, pc 6c2014)
    /system/framework/services.jar (com.android.server.pm.ShortcutService$5.onReceive+54, pc 33bb1a)
    /system/framework/arm64/boot-framework.oat (android.app.LoadedApk$ReceiverDispatcher$Args.lambda$getRunnable$0+1004, pc 30924c)
    /system/framework/arm64/boot-framework.oat (android.app.LoadedApk$ReceiverDispatcher$Args$$ExternalSyntheticLambda0.run+52, pc 220ee4)
    /system/framework/arm64/boot-framework.oat (android.os.Handler.dispatchMessage+68, pc 4f3854)
    /system/framework/arm64/boot-framework.oat (android.os.Looper.loopOnce+980, pc 4f6884)
    /system/framework/arm64/boot-framework.oat (android.os.Looper.loop+244, pc 4f6434)
    /system/framework/arm64/boot-framework.oat (android.os.HandlerThread.run+548, pc 4f5864)
    /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612, pc 3a4374)
    /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+144, pc 3415f0)
    /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1720, pc 49ce78)
    /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8, pc 49c7a8)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)
thestinger commented 1 month ago

Doesn't appear to have been reported to us before. Almost certainly an upstream Android bug. Might have been detected by our hardening but that's not clear.