34.0.4-1 breaks fastboot

added priority3-normal scopebug severity4-low statusconfirmed labels

Added 2023-09-14 21:52:09 UTC - Commented by Toolybird (Toolybird)

This doesn't appear to be an Arch packaging issue. You'll likely have better luck reporting the problem upstream. Please let us know what you find out.

Added 2023-10-03 09:38:51 UTC - Commented by q rty (q234rty)

I believe this particular error is enabled by -Wp,-D_GLIBCXX_ASSERTIONS in the devtools makepkg.conf, I guess that flag is not there in google's build system?

Added 2023-10-04 06:00:57 UTC - Commented by Toolybird (Toolybird)

Merging FS#79847 here.

Added 2023-11-09 19:35:30 UTC - Commented by H. Cristiano Alves Machado (mccurly)

Hello to all.

This is still present with android-tools-34.0.4-3. I must say my technical skills are very limited. Nevertheless, if downgrading to previous android-tools-33.0.3-3, it fixes my problem. (I don't know at what expense, but for the moment it seems that I can use fastboot as usual).

Can anyone of acknowledge that this issue is still there?

Thank you.

Added 2023-11-10 14:46:51 UTC - Commented by loqs (loqs)

Perhaps upstream might be more interested if a fix was provided. A backtrace would help locating where in the code the assertion is triggered. Please provide a backtrace that includes debugging information. Please read the following links 1 3. It's usually as simple as (with gdb installed):

$ coredumpctl gdb (then answer y when it asks "Enable debuginfod for this session?") (gdb) set logging enabled (gdb) bt (or bt full)

Then post gdb.txt

assigned to @anatolik and @ffy00

I am having the same issue. Next time I will need to upgrade my Android device I will try to provide a backtrace.

I encountered this exact issue while running Fairphone's fastboot flash script for my FP5. Attached is the backtrace: fastboot-trace.log Currently on 6.7.1-zen1-1-zen and using android-tools 34.0.4-3. Wish I was aware of this bug before trying to flash my phone because now it's bricked... Fairphone doesn't provide its firehose file either so RIP

have same issue like others see: https://xdaforums.com/t/some-std-out_of_range-error-with-fastboot-on-linux.4626285/

terminate called after throwing an instance of 'std::out_of_range' what(): basic_string::compare: __pos (which is 496) > this->size() (which is 0) ./flash_new_all.sh: line 54: 246859 Aborted (core dumped) fastboot -S 200M flash rootfs debian/rootfs.img

fastboot --version fastboot version 34.0.4-android-tools Installed as /usr/bin/fastboot

downloaded latest version from, which worked now: https://developer.android.com/tools/releases/platform-tools

fastboot version 34.0.5-10900879 Installed as /usr/bin/fastboot

Looked a bit more into this today.

The code crashes at https://android.googlesource.com/platform/system/core/+/refs/tags/platform-tools-34.0.4/fastboot/fastboot.cpp#1214 (std::string data has 0 bytes and pos/footer_offset is higher than the string length, so we get an exception)

When the android-tools package is compiled without the extra flags from makepkg.conf (presumably somewhat similar to how the official platform-tools is built) then flashing continues with the following output:

$ fastboot --verbose flash super super.img
fastboot: verbose: Do flash super super.img
fastboot: verbose: target reported max-download-size of 805306368 bytes
Warning: skip copying super image avb footer (super partition size: 6442450944, super image size: 140723775805952).
Sending sparse 'super' 1/6 (722560 KB)

diff --git a/PKGBUILD b/PKGBUILD
index 2f17f93..0768c06 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -5,7 +5,7 @@
 pkgname=android-tools
 pkgver=34.0.4
 _tag=${pkgver} # https://github.com/nmeum/android-tools sometimes carries extra patch version on top of the upstream versioning
-pkgrel=3
+pkgrel=4
 pkgdesc='Android platform tools'
 arch=(x86_64)
 url='http://tools.android.com/'
@@ -21,8 +21,8 @@ build() {
   cmake \
     -DCMAKE_INSTALL_PREFIX=/usr \
     -DCMAKE_BUILD_TYPE=Release \
-    -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
-    -DCMAKE_C_FLAGS="$CFLAGS" \
+    -DCMAKE_CXX_FLAGS="" \
+    -DCMAKE_C_FLAGS="" \
     -DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON \
     -Dprotobuf_MODULE_COMPATIBLE=ON \
     -G Ninja -S . -B build

If we look closer at the output, the 140723775805952 cannot be a real size, that's ~127 TiB.

And every time we run it, we get a different "super image size"...

Warning: skip copying super image avb footer (super partition size: 6442450944, super image size: 140725918572192).

Warning: skip copying super image avb footer (super partition size: 6442450944, super image size: 140737306734848).

Warning: skip copying super image avb footer (super partition size: 6442450944, super image size: 140723648418544).

For now it feels like it's more of an accident it works normally due to the code hitting some sort of memory management issue?

But official built android-tools (r34.0.4) don't have this output at all?

Will try to find out more and update this comment.

@lucaweiss thank you for debugging the issue.

When one sees random used values in a C/C++ program it is almost always due-to uninitialized memory area. I am looking at the code you shared I see it due to randomness of

uint64_t footer_offset = buf->sz - AVB_FOOTER_SIZE;

And some lines it is where buf structure is allocated, and indeed it lacks proper initialization

struct fastboot_buffer buf;

https://android.googlesource.com/platform/system/core/+/refs/tags/platform-tools-34.0.4/fastboot/fastboot.cpp#1490

The code above should be replaced with

struct fastboot_buffer buf = {0};

I also see that other initialization paths do not set ->sz field in this structure, e.g. here

https://android.googlesource.com/platform/system/core/+/refs/tags/platform-tools-34.0.4/fastboot/fastboot.cpp#1060

buf->fd = std::move(fd);
    if (limit) {
        buf->files = load_sparse_files(buf->fd.get(), limit);
        if (buf->files.empty()) {
            return false;
        }
        buf->type = FB_BUFFER_SPARSE;
    } else {
        buf->type = FB_BUFFER_FD;
        buf->sz = sz;
    }

You can try to updtae the sources and see it fixes the functionality.

But in ether case it is an upstream issue that need to be reported/fixed there as well.

mentioned in merge request !2 (closed)

@anatolik Yep, seems it's that variable that causes the issue. Opened !2 (closed) with a patch to fix it (tested with the file where it broke for me)

For reference, when built with AOSP tooling, it seems the struct does get initialized automatically (probably some compiler flags)

fastboot: verbose: Do flash super super.img
buf->sz=0
fastboot: verbose: target reported max-download-size of 805306368 bytes
sz=0 is_logical=0
Sending sparse 'super' 1/6 (722560 KB)

So with this =0 the first if in copy_avb_footer is taken and we return from the function without running the rest of the code - which would then crash.

From the upstream ticket it appears Android builds it with -ftrivial-auto-var-init=zero which explains the anomaly. Therefore, we should probably follow suit.

Thank you for debugging it!

-ftrivial-auto-var-init=zero is fine with me. But this issue/patch need to be posted to https://github.com/nmeum/android-tools/ that is upsteram for this package. @lucaweiss or @toolybird could you please post your finding there?

Opened https://github.com/nmeum/android-tools/issues/133 in the repo there.

Could you please rebuild with this flag for now, so that users stop bricking their devices?

I feel this should've been done as soon as it was discovered TBH, a typical user won't know about this issue until it's already occurred.

Alright, let's move forward with the proposed fix.

I just pushed a patched version of the package to testing repo. Please try and let me know if you still see the issue.

Looks fixed to me with d8c4c02a. Should progress out of testing soon..

closed

added resolutioncompleted label

Task Info (Flyspray)
Opened By	Luca Weiss (z3ntu)
Task ID	79685
Type	Bug Report
Project	Arch Linux
Category	Packages: Extra
Version	None
OS	All
Opened	2023-09-14 08:14:18 UTC
Status	Assigned
Assignee	Anatol Pomozov (anatolik)
Assignee	Filipe Laíns (FFY00)

34.0.4-1 breaks fastboot

Details

Child items ...

Activity

Admin message

34.0.4-1 breaks fastboot

Details

Activity