Hi Igor, Thank you for the patch.
On Mon, Oct 12, 2026 at 22:25, Igor Opaniuk <[email protected]> wrote: > bootmeth_android let libavb read boot and vendor_boot into its own buffers, > hash them and free them, and then read both partitions again to boot them. > The bytes that were verified and the bytes that were booted were therefore > two separate reads of the storage device, which an attacker able to > interpose the device can tell apart (reported on the list as a TOCTOU > issue). It also read every image twice. > > Load boot and vendor_boot first and hand the buffers to libavb through > AvbOps.get_preloaded_partition(), so the hashes are computed over the > memory that bootm consumes afterwards. If a hash descriptor covers more > bytes than the boot image header announced, the tail is read into the same > buffer, bounded by the partition size; a descriptor larger than the buffer > fails verification. > > Reported-by: Ahmad Fatoum <[email protected]> Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android") > Signed-off-by: Igor Opaniuk <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> > ---
