From 6be69d8f3bff9c098243af996e88a4023df24c77 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Mon, 17 May 2021 19:02:39 +0800 Subject: [PATCH] Corrupt the PersistentDataBlock payload explicitly in factory reset The current formatPartitionLocked only sets the data length to zero and leave the payload unchanged. If the client side ignores the header and read the payload directly, it still has the chance to read old data. This CL corrupts the payload explicitly in formatPartitionLocked. Bug: 185369514 Test: \ 1. Flash device, wipe 2. Go through SUW with a google account. Set a PIN. 3. Factory Reset through Settings. 4. In SUW, when setting up an account (or copy from an old device), it should not ask for the previous PIN. Change-Id: Ib60c68e3e91a4f0a7fd4e86b462091995bbe4fe2 --- .../com/android/server/PersistentDataBlockService.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/PersistentDataBlockService.java b/services/core/java/com/android/server/PersistentDataBlockService.java index c6fdb9df49e96..e109b8793a179 100644 --- a/services/core/java/com/android/server/PersistentDataBlockService.java +++ b/services/core/java/com/android/server/PersistentDataBlockService.java @@ -38,11 +38,9 @@ import com.android.internal.annotations.GuardedBy; import libcore.io.IoUtils; import java.io.DataInputStream; -import java.io.DataOutputStream; import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; -import java.io.FileOutputStream; import java.io.IOException; import java.io.RandomAccessFile; import java.nio.ByteBuffer; @@ -375,11 +373,16 @@ public class PersistentDataBlockService extends SystemService { try { FileChannel channel = getBlockOutputChannel(); - ByteBuffer buf = ByteBuffer.allocate(DIGEST_SIZE_BYTES + HEADER_SIZE); + int header_size = DIGEST_SIZE_BYTES + HEADER_SIZE; + ByteBuffer buf = ByteBuffer.allocate(header_size); buf.put(new byte[DIGEST_SIZE_BYTES]); buf.putInt(PARTITION_TYPE_MARKER); buf.putInt(0); channel.write(buf); + // corrupt the payload explicitly + int payload_size = (int) getBlockDeviceSize() - header_size; + buf = ByteBuffer.allocate(payload_size); + channel.write(buf); channel.force(true); } catch (IOException e) { Slog.e(TAG, "failed to format block", e);