Merge "Removing {userspace} from reboot task'"diff --git a/debuggerd/debuggerd_test.cpp b/debuggerd/debuggerd_test.cpp
index a00a202..39d7fff 100644
--- a/debuggerd/debuggerd_test.cpp
+++ b/debuggerd/debuggerd_test.cpp
@@ -20,6 +20,7 @@
#include <fcntl.h>
#include <linux/prctl.h>
#include <malloc.h>
+#include <pthread.h>
#include <stdlib.h>
#include <sys/capability.h>
#include <sys/mman.h>
@@ -2703,3 +2704,58 @@
}
ASSERT_TRUE(found_valid_elf) << "Did not find any elf files with valid BuildIDs to check.";
}
+
+const char kLogMessage[] = "Should not see this log message.";
+
+// Verify that the logd process does not read the log.
+TEST_F(CrasherTest, logd_skips_reading_logs) {
+ StartProcess([]() {
+ pthread_setname_np(pthread_self(), "logd");
+ LOG(INFO) << kLogMessage;
+ abort();
+ });
+
+ unique_fd output_fd;
+ StartIntercept(&output_fd);
+ FinishCrasher();
+ AssertDeath(SIGABRT);
+ int intercept_result;
+ FinishIntercept(&intercept_result);
+ ASSERT_EQ(1, intercept_result) << "tombstoned reported failure";
+
+ std::string result;
+ ConsumeFd(std::move(output_fd), &result);
+ // logd should not contain our log message.
+ ASSERT_NOT_MATCH(result, kLogMessage);
+}
+
+// Verify that the logd process does not read the log when the non-main
+// thread crashes.
+TEST_F(CrasherTest, logd_skips_reading_logs_not_main_thread) {
+ StartProcess([]() {
+ pthread_setname_np(pthread_self(), "logd");
+ LOG(INFO) << kLogMessage;
+
+ std::thread thread([]() {
+ pthread_setname_np(pthread_self(), "not_logd_thread");
+ // Raise the signal on the side thread.
+ raise_debugger_signal(kDebuggerdTombstone);
+ });
+ thread.join();
+ _exit(0);
+ });
+
+ unique_fd output_fd;
+ StartIntercept(&output_fd, kDebuggerdTombstone);
+ FinishCrasher();
+ AssertDeath(0);
+
+ int intercept_result;
+ FinishIntercept(&intercept_result);
+ ASSERT_EQ(1, intercept_result) << "tombstoned reported failure";
+
+ std::string result;
+ ConsumeFd(std::move(output_fd), &result);
+ ASSERT_BACKTRACE_FRAME(result, "raise_debugger_signal");
+ ASSERT_NOT_MATCH(result, kLogMessage);
+}
diff --git a/debuggerd/libdebuggerd/tombstone_proto.cpp b/debuggerd/libdebuggerd/tombstone_proto.cpp
index 9a565de..acd814e 100644
--- a/debuggerd/libdebuggerd/tombstone_proto.cpp
+++ b/debuggerd/libdebuggerd/tombstone_proto.cpp
@@ -690,7 +690,14 @@
// Only dump logs on debuggable devices.
if (android::base::GetBoolProperty("ro.debuggable", false)) {
- dump_logcat(&result, main_thread.pid);
+ // Get the thread that corresponds to the main pid of the process.
+ const ThreadInfo& thread = threads.at(main_thread.pid);
+
+ // Do not attempt to dump logs of the logd process because the gathering
+ // of logs can hang until a timeout occurs.
+ if (thread.thread_name != "logd") {
+ dump_logcat(&result, main_thread.pid);
+ }
}
dump_open_fds(&result, open_files);
diff --git a/fs_mgr/libsnapshot/snapshot_test.cpp b/fs_mgr/libsnapshot/snapshot_test.cpp
index 460d49d..f472bab 100644
--- a/fs_mgr/libsnapshot/snapshot_test.cpp
+++ b/fs_mgr/libsnapshot/snapshot_test.cpp
@@ -196,6 +196,17 @@
return true;
}
+ bool ShouldSkipLegacyMerging() {
+ if (!GetLegacyCompressionEnabledProperty() || !snapuserd_required_) {
+ return false;
+ }
+ int api_level = android::base::GetIntProperty("ro.board.api_level", -1);
+ if (api_level == -1) {
+ api_level = android::base::GetIntProperty("ro.product.first_api_level", -1);
+ }
+ return api_level != __ANDROID_API_S__;
+ }
+
void InitializeState() {
ASSERT_TRUE(sm->EnsureImageManager());
image_manager_ = sm->image_manager();
@@ -654,6 +665,10 @@
test_device->set_slot_suffix("_b");
ASSERT_TRUE(sm->CreateLogicalAndSnapshotPartitions("super", snapshot_timeout_));
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(sm->InitiateMerge());
// The device should have been switched to a snapshot-merge target.
@@ -761,6 +776,10 @@
ASSERT_NE(init, nullptr);
ASSERT_TRUE(init->NeedSnapshotsInFirstStageMount());
ASSERT_TRUE(init->CreateLogicalAndSnapshotPartitions("super", snapshot_timeout_));
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
// Now, reflash super. Note that we haven't called ProcessUpdateState, so the
@@ -1344,6 +1363,10 @@
}
// Initiate the merge and wait for it to be completed.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(init->IsSnapuserdRequired(), snapuserd_required_);
{
@@ -1407,6 +1430,10 @@
ASSERT_TRUE(init->CreateLogicalAndSnapshotPartitions("super", snapshot_timeout_));
// Initiate the merge and wait for it to be completed.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(UpdateState::MergeCompleted, init->ProcessUpdateState());
}
@@ -1476,6 +1503,10 @@
}
// Initiate the merge and wait for it to be completed.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(init->IsSnapuserdRequired(), snapuserd_required_);
{
@@ -1584,6 +1615,10 @@
});
// Initiate the merge and wait for it to be completed.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(init->IsSnapuserdRequired(), snapuserd_required_);
{
@@ -1786,6 +1821,10 @@
// Initiate the merge and wait for it to be completed.
auto new_sm = SnapshotManager::New(new TestDeviceInfo(fake_super, "_b"));
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(new_sm->InitiateMerge());
ASSERT_EQ(UpdateState::MergeCompleted, new_sm->ProcessUpdateState());
@@ -1924,6 +1963,10 @@
ASSERT_GE(fd, 0);
// COW cannot be removed due to open fd, so expect a soft failure.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(UpdateState::MergeNeedsReboot, init->ProcessUpdateState());
@@ -2027,6 +2070,10 @@
// Initiate the merge and then immediately stop it to simulate a reboot.
auto new_sm = SnapshotManager::New(new TestDeviceInfo(fake_super, "_b"));
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(new_sm->InitiateMerge());
ASSERT_TRUE(UnmapAll());
@@ -2059,6 +2106,10 @@
// Initiate the merge and then immediately stop it to simulate a reboot.
auto new_sm = SnapshotManager::New(new TestDeviceInfo(fake_super, "_b"));
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(new_sm->InitiateMerge());
ASSERT_TRUE(UnmapAll());
@@ -2136,6 +2187,10 @@
// Test update package that requests data wipe.
TEST_F(SnapshotUpdateTest, DataWipeRequiredInPackage) {
+ if (ShouldSkipLegacyMerging()) {
+ GTEST_SKIP() << "Skipping legacy merge in test";
+ }
+
AddOperationForPartitions();
// Execute the update.
ASSERT_TRUE(sm->BeginUpdate());
@@ -2175,6 +2230,10 @@
// Test update package that requests data wipe.
TEST_F(SnapshotUpdateTest, DataWipeWithStaleSnapshots) {
+ if (ShouldSkipLegacyMerging()) {
+ GTEST_SKIP() << "Skipping legacy merge in test";
+ }
+
AddOperationForPartitions();
// Execute the update.
@@ -2397,6 +2456,10 @@
}
// Initiate the merge and wait for it to be completed.
+ if (ShouldSkipLegacyMerging()) {
+ LOG(INFO) << "Skipping legacy merge in test";
+ return;
+ }
ASSERT_TRUE(init->InitiateMerge());
ASSERT_EQ(UpdateState::MergeCompleted, init->ProcessUpdateState());
diff --git a/healthd/BatteryMonitor.cpp b/healthd/BatteryMonitor.cpp
index 66e1e63..f68d65a 100644
--- a/healthd/BatteryMonitor.cpp
+++ b/healthd/BatteryMonitor.cpp
@@ -242,6 +242,8 @@
value = BatteryHealth::DEAD;
else if (status == BatteryMonitor::BH_FAILED)
value = BatteryHealth::UNSPECIFIED_FAILURE;
+ else if (status == BatteryMonitor::BH_NOT_AVAILABLE)
+ value = BatteryHealth::NOT_AVAILABLE;
else
value = BatteryHealth::UNKNOWN;
diff --git a/healthd/include/healthd/BatteryMonitor.h b/healthd/include/healthd/BatteryMonitor.h
index 7b4f46c..a4c013b 100644
--- a/healthd/include/healthd/BatteryMonitor.h
+++ b/healthd/include/healthd/BatteryMonitor.h
@@ -62,6 +62,7 @@
BH_MARGINAL,
BH_NEEDS_REPLACEMENT,
BH_FAILED,
+ BH_NOT_AVAILABLE,
};
BatteryMonitor();
diff --git a/init/service.cpp b/init/service.cpp
index 35beaad..c152081 100644
--- a/init/service.cpp
+++ b/init/service.cpp
@@ -140,9 +140,10 @@
Service::Service(const std::string& name, Subcontext* subcontext_for_restart_commands,
const std::string& filename, const std::vector<std::string>& args)
- : Service(name, 0, 0, 0, {}, 0, "", subcontext_for_restart_commands, filename, args) {}
+ : Service(name, 0, std::nullopt, 0, {}, 0, "", subcontext_for_restart_commands, filename,
+ args) {}
-Service::Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid,
+Service::Service(const std::string& name, unsigned flags, std::optional<uid_t> uid, gid_t gid,
const std::vector<gid_t>& supp_gids, int namespace_flags,
const std::string& seclabel, Subcontext* subcontext_for_restart_commands,
const std::string& filename, const std::vector<std::string>& args)
@@ -153,7 +154,7 @@
crash_count_(0),
proc_attr_{.ioprio_class = IoSchedClass_NONE,
.ioprio_pri = 0,
- .uid = uid,
+ .parsed_uid = uid,
.gid = gid,
.supp_gids = supp_gids,
.priority = 0},
@@ -205,9 +206,9 @@
int max_processes = 0;
int r;
if (signal == SIGTERM) {
- r = killProcessGroupOnce(proc_attr_.uid, pid_, signal, &max_processes);
+ r = killProcessGroupOnce(uid(), pid_, signal, &max_processes);
} else {
- r = killProcessGroup(proc_attr_.uid, pid_, signal, &max_processes);
+ r = killProcessGroup(uid(), pid_, signal, &max_processes);
}
if (report_oneshot && max_processes > 0) {
@@ -228,7 +229,7 @@
void Service::SetProcessAttributesAndCaps(InterprocessFifo setsid_finished) {
// Keep capabilites on uid change.
- if (capabilities_ && proc_attr_.uid) {
+ if (capabilities_ && uid()) {
// If Android is running in a container, some securebits might already
// be locked, so don't change those.
unsigned long securebits = prctl(PR_GET_SECUREBITS);
@@ -255,7 +256,7 @@
if (!SetCapsForExec(*capabilities_)) {
LOG(FATAL) << "cannot set capabilities for " << name_;
}
- } else if (proc_attr_.uid) {
+ } else if (uid()) {
// Inheritable caps can be non-zero when running in a container.
if (!DropInheritableCaps()) {
LOG(FATAL) << "cannot drop inheritable caps for " << name_;
@@ -434,8 +435,8 @@
flags_ |= SVC_EXEC;
is_exec_service_running_ = true;
- LOG(INFO) << "SVC_EXEC service '" << name_ << "' pid " << pid_ << " (uid " << proc_attr_.uid
- << " gid " << proc_attr_.gid << "+" << proc_attr_.supp_gids.size() << " context "
+ LOG(INFO) << "SVC_EXEC service '" << name_ << "' pid " << pid_ << " (uid " << uid() << " gid "
+ << proc_attr_.gid << "+" << proc_attr_.supp_gids.size() << " context "
<< (!seclabel_.empty() ? seclabel_ : "default") << ") started; waiting...";
reboot_on_failure.Disable();
@@ -475,13 +476,13 @@
// Configures the memory cgroup properties for the service.
void Service::ConfigureMemcg() {
if (swappiness_ != -1) {
- if (!setProcessGroupSwappiness(proc_attr_.uid, pid_, swappiness_)) {
+ if (!setProcessGroupSwappiness(uid(), pid_, swappiness_)) {
PLOG(ERROR) << "setProcessGroupSwappiness failed";
}
}
if (soft_limit_in_bytes_ != -1) {
- if (!setProcessGroupSoftLimit(proc_attr_.uid, pid_, soft_limit_in_bytes_)) {
+ if (!setProcessGroupSoftLimit(uid(), pid_, soft_limit_in_bytes_)) {
PLOG(ERROR) << "setProcessGroupSoftLimit failed";
}
}
@@ -508,7 +509,7 @@
}
if (computed_limit_in_bytes != size_t(-1)) {
- if (!setProcessGroupLimit(proc_attr_.uid, pid_, computed_limit_in_bytes)) {
+ if (!setProcessGroupLimit(uid(), pid_, computed_limit_in_bytes)) {
PLOG(ERROR) << "setProcessGroupLimit failed";
}
}
@@ -705,21 +706,20 @@
if (CgroupsAvailable()) {
bool use_memcg = swappiness_ != -1 || soft_limit_in_bytes_ != -1 || limit_in_bytes_ != -1 ||
limit_percent_ != -1 || !limit_property_.empty();
- errno = -createProcessGroup(proc_attr_.uid, pid_, use_memcg);
+ errno = -createProcessGroup(uid(), pid_, use_memcg);
if (errno != 0) {
Result<void> result = cgroups_activated.Write(kActivatingCgroupsFailed);
if (!result.ok()) {
return Error() << "Sending notification failed: " << result.error();
}
- return Error() << "createProcessGroup(" << proc_attr_.uid << ", " << pid_ << ", "
- << use_memcg << ") failed for service '" << name_
- << "': " << strerror(errno);
+ return Error() << "createProcessGroup(" << uid() << ", " << pid_ << ", " << use_memcg
+ << ") failed for service '" << name_ << "': " << strerror(errno);
}
// When the blkio controller is mounted in the v1 hierarchy, NormalIoPriority is
// the default (/dev/blkio). When the blkio controller is mounted in the v2 hierarchy, the
// NormalIoPriority profile has to be applied explicitly.
- SetProcessProfiles(proc_attr_.uid, pid_, {"NormalIoPriority"});
+ SetProcessProfiles(uid(), pid_, {"NormalIoPriority"});
if (use_memcg) {
ConfigureMemcg();
@@ -727,7 +727,7 @@
}
if (oom_score_adjust_ != DEFAULT_OOM_SCORE_ADJUST) {
- LmkdRegister(name_, proc_attr_.uid, pid_, oom_score_adjust_);
+ LmkdRegister(name_, uid(), pid_, oom_score_adjust_);
}
if (Result<void> result = cgroups_activated.Write(kCgroupsActivated); !result.ok()) {
diff --git a/init/service.h b/init/service.h
index 3ef8902..ce7c0da 100644
--- a/init/service.h
+++ b/init/service.h
@@ -71,7 +71,7 @@
Service(const std::string& name, Subcontext* subcontext_for_restart_commands,
const std::string& filename, const std::vector<std::string>& args);
- Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid,
+ Service(const std::string& name, unsigned flags, std::optional<uid_t> uid, gid_t gid,
const std::vector<gid_t>& supp_gids, int namespace_flags, const std::string& seclabel,
Subcontext* subcontext_for_restart_commands, const std::string& filename,
const std::vector<std::string>& args);
@@ -115,7 +115,7 @@
pid_t pid() const { return pid_; }
android::base::boot_clock::time_point time_started() const { return time_started_; }
int crash_count() const { return crash_count_; }
- uid_t uid() const { return proc_attr_.uid; }
+ uid_t uid() const { return proc_attr_.uid(); }
gid_t gid() const { return proc_attr_.gid; }
int namespace_flags() const { return namespaces_.flags; }
const std::vector<gid_t>& supp_gids() const { return proc_attr_.supp_gids; }
diff --git a/init/service_parser.cpp b/init/service_parser.cpp
index 3563084..d89664c 100644
--- a/init/service_parser.cpp
+++ b/init/service_parser.cpp
@@ -534,7 +534,7 @@
if (!uid.ok()) {
return Error() << "Unable to find UID for '" << args[1] << "': " << uid.error();
}
- service_->proc_attr_.uid = *uid;
+ service_->proc_attr_.parsed_uid = *uid;
return {};
}
@@ -677,6 +677,11 @@
return {};
}
+ if (service_->proc_attr_.parsed_uid == std::nullopt) {
+ LOG(WARNING) << "No user specified for service '" << service_->name()
+ << "'. Defaults to root.";
+ }
+
if (interface_inheritance_hierarchy_) {
if (const auto& check_hierarchy_result = CheckInterfaceInheritanceHierarchy(
service_->interfaces(), *interface_inheritance_hierarchy_);
diff --git a/init/service_utils.cpp b/init/service_utils.cpp
index 7004d8d..0e19bcc 100644
--- a/init/service_utils.cpp
+++ b/init/service_utils.cpp
@@ -271,8 +271,8 @@
if (setgroups(attr.supp_gids.size(), const_cast<gid_t*>(&attr.supp_gids[0])) != 0) {
return ErrnoError() << "setgroups failed";
}
- if (attr.uid) {
- if (setuid(attr.uid) != 0) {
+ if (attr.uid()) {
+ if (setuid(attr.uid()) != 0) {
return ErrnoError() << "setuid failed";
}
}
diff --git a/init/service_utils.h b/init/service_utils.h
index d4143aa..27ec450 100644
--- a/init/service_utils.h
+++ b/init/service_utils.h
@@ -91,11 +91,13 @@
IoSchedClass ioprio_class;
int ioprio_pri;
std::vector<std::pair<int, rlimit>> rlimits;
- uid_t uid;
+ std::optional<uid_t> parsed_uid;
gid_t gid;
std::vector<gid_t> supp_gids;
int priority;
bool stdio_to_kmsg;
+
+ uid_t uid() const { return parsed_uid.value_or(0); }
};
inline bool RequiresConsole(const ProcessAttributes& attr) {
diff --git a/libprocessgroup/processgroup.cpp b/libprocessgroup/processgroup.cpp
index a021594..e294260 100644
--- a/libprocessgroup/processgroup.cpp
+++ b/libprocessgroup/processgroup.cpp
@@ -216,7 +216,6 @@
static int RemoveProcessGroup(const char* cgroup, uid_t uid, int pid, unsigned int retries) {
int ret = 0;
auto uid_pid_path = ConvertUidPidToPath(cgroup, uid, pid);
- auto uid_path = ConvertUidToPath(cgroup, uid);
while (retries--) {
ret = rmdir(uid_pid_path.c_str());
diff --git a/storaged/Android.bp b/storaged/Android.bp
index c3447d2..04f5d79 100644
--- a/storaged/Android.bp
+++ b/storaged/Android.bp
@@ -136,3 +136,27 @@
],
path: "binder",
}
+
+cc_fuzz {
+ name: "storaged_service_fuzzer",
+ defaults: [
+ "storaged_defaults",
+ "service_fuzzer_defaults",
+ ],
+ srcs: ["tests/fuzzers/storaged_service_fuzzer.cpp"],
+ static_libs: [
+ "libstoraged",
+ ],
+}
+
+cc_fuzz {
+ name: "storaged_private_service_fuzzer",
+ defaults: [
+ "storaged_defaults",
+ "service_fuzzer_defaults",
+ ],
+ srcs: ["tests/fuzzers/storaged_private_service_fuzzer.cpp"],
+ static_libs: [
+ "libstoraged",
+ ],
+}
\ No newline at end of file
diff --git a/storaged/include/storaged_service.h b/storaged/include/storaged_service.h
index 7ec6864..bf7af80 100644
--- a/storaged/include/storaged_service.h
+++ b/storaged/include/storaged_service.h
@@ -28,6 +28,7 @@
using namespace android::os;
using namespace android::os::storaged;
+namespace android {
class StoragedService : public BinderService<StoragedService>, public BnStoraged {
private:
void dumpUidRecordsDebug(int fd, const vector<struct uid_record>& entries);
@@ -53,4 +54,5 @@
sp<IStoragedPrivate> get_storaged_pri_service();
+} // namespace android
#endif /* _STORAGED_SERVICE_H_ */
\ No newline at end of file
diff --git a/storaged/storaged_service.cpp b/storaged/storaged_service.cpp
index 45f1d4d..00d36d7 100644
--- a/storaged/storaged_service.cpp
+++ b/storaged/storaged_service.cpp
@@ -38,6 +38,7 @@
extern sp<storaged_t> storaged_sp;
+namespace android {
status_t StoragedService::start() {
return BinderService<StoragedService>::publish();
}
@@ -218,3 +219,4 @@
return interface_cast<IStoragedPrivate>(binder);
}
+} // namespace android
\ No newline at end of file
diff --git a/storaged/tests/fuzzers/storaged_private_service_fuzzer.cpp b/storaged/tests/fuzzers/storaged_private_service_fuzzer.cpp
new file mode 100644
index 0000000..82eb796
--- /dev/null
+++ b/storaged/tests/fuzzers/storaged_private_service_fuzzer.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fuzzbinder/libbinder_driver.h>
+
+#include <storaged.h>
+#include <storaged_service.h>
+
+sp<storaged_t> storaged_sp;
+
+extern "C" int LLVMFuzzerInitialize(int /**argc*/, char /****argv*/) {
+ storaged_sp = new storaged_t();
+ storaged_sp->init();
+ return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ auto storagedPrivateService = new StoragedPrivateService();
+ fuzzService(storagedPrivateService, FuzzedDataProvider(data, size));
+ return 0;
+}
\ No newline at end of file
diff --git a/storaged/tests/fuzzers/storaged_service_fuzzer.cpp b/storaged/tests/fuzzers/storaged_service_fuzzer.cpp
new file mode 100644
index 0000000..d11ecc3
--- /dev/null
+++ b/storaged/tests/fuzzers/storaged_service_fuzzer.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fuzzbinder/libbinder_driver.h>
+
+#include <storaged.h>
+#include <storaged_service.h>
+
+sp<storaged_t> storaged_sp;
+
+extern "C" int LLVMFuzzerInitialize(int /**argc*/, char /****argv*/) {
+ storaged_sp = new storaged_t();
+ storaged_sp->init();
+ return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ auto storagedService = new StoragedService();
+ fuzzService(storagedService, FuzzedDataProvider(data, size));
+ return 0;
+}
\ No newline at end of file