chenxiaolong / avbroot

Sign (and root) Android A/B OTAs with custom keys while preserving Android Verified Boot
GNU General Public License v3.0
436 stars 41 forks source link

Occasional hang with 100% CPU usage when interrupting avbroot during payload extraction #285

Closed chenxiaolong closed 1 month ago

chenxiaolong commented 1 month ago

This is a bug in the Rust bzip2 bindings, which is unfortunately no longer maintained and has multiple infinite-loop-in-destructor bugs.

avbroot already points to a fork of the library that includes one of the fixes. I may need to make my own fork to pull in multiple fixes that others have already made.

Stack trace:

Thread 14 (Thread 0x7f1b436006c0 (LWP 43696) "avbroot"):
#0  0x00007f1b4abb914b in BZ2_decompress (s=s@entry=0x7f1af800f740) at /usr/src/debug/bzip2-1.0.8-18.fc40.x86_64/decompress.c:111
#1  0x00007f1b4abbbd8b in BZ2_bzDecompress (strm=<optimized out>) at /usr/src/debug/bzip2-1.0.8-18.fc40.x86_64/bzlib.c:842
#2  0x00005615152c5b51 in bzip2::mem::Decompress::decompress_vec ()
#3  0x00005615151d7cdb in core::ptr::drop_in_place<bzip2::write::BzDecoder<&mut alloc::boxed::Box<dyn avbroot::stream::WriteSeek>>> ()
#4  0x00005615151a490a in avbroot::format::payload::apply_operation ()
#5  0x000056151519f3cc in core::ops::function::impls::<impl core::ops::function::FnMut<A> for &F>::call_mut ()
#6  0x00005615151f2b30 in <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::fold ()
#7  0x000056151521c95e in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#8  0x000056151521f517 in rayon_core::job::StackJob<L,F,R>::run_inline ()
#9  0x0000561514fea562 in rayon_core::join::join_context::{{closure}} ()
#10 0x0000561514fefbb1 in rayon_core::registry::in_worker ()
#11 0x000056151521ca22 in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#12 0x0000561514fea484 in rayon_core::join::join_context::{{closure}} ()
#13 0x0000561514fefbb1 in rayon_core::registry::in_worker ()
#14 0x000056151521ca22 in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#15 0x0000561514fea484 in rayon_core::join::join_context::{{closure}} ()
#16 0x0000561514fefbb1 in rayon_core::registry::in_worker ()
#17 0x000056151521ca22 in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#18 0x0000561515229398 in <rayon_core::job::StackJob<L,F,R> as rayon_core::job::Job>::execute ()
#19 0x00005615154428e6 in rayon_core::registry::WorkerThread::wait_until_cold ()
#20 0x0000561514fea57d in rayon_core::join::join_context::{{closure}} ()
#21 0x0000561514fefbb1 in rayon_core::registry::in_worker ()
#22 0x000056151521ca22 in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#23 0x0000561514fea484 in rayon_core::join::join_context::{{closure}} ()
#24 0x0000561514fefbb1 in rayon_core::registry::in_worker ()
#25 0x000056151521ca22 in rayon::iter::plumbing::bridge_producer_consumer::helper ()
#26 0x0000561515229398 in <rayon_core::job::StackJob<L,F,R> as rayon_core::job::Job>::execute ()
#27 0x00005615154428e6 in rayon_core::registry::WorkerThread::wait_until_cold ()
#28 0x0000561515440bd2 in rayon_core::registry::ThreadBuilder::run ()
#29 0x0000561515444688 in std::sys_common::backtrace::__rust_begin_short_backtrace ()
#30 0x0000561515445401 in core::ops::function::FnOnce::call_once{{vtable.shim}} ()
#31 0x00005615154e4aa5 in std::sys::pal::unix::thread::Thread::new::thread_start ()
#32 0x00007f1b4a9141b7 in start_thread (arg=<optimized out>) at pthread_create.c:447
#33 0x00007f1b4a99639c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
chenxiaolong commented 1 month ago

https://github.com/alexcrichton/bzip2-rs/pull/97 (not used in avbroot) and https://github.com/alexcrichton/bzip2-rs/issues/98 (used in avbroot) don't fix this specific problem. It looks like there's a third infinite-loop-on-drop bug.