Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca0c2cb7 authored by T.J. Mercier's avatar T.J. Mercier
Browse files

Do not set FLAT_BINDER_FLAG_* on object of type BINDER_TYPE_FD 

Parcel::writeFileDescriptor should be creating a binder_fd_object and
serializing it for submission to the binder driver. However the common
Parcel::writeObject function takes a flat_binder_object as an argument,
so writeFileDescriptor creates a flat_binder_object and uses the memory
locations equivalent to the correct fields in binder_fd_object. That
works, but in the process the flags field of the object is populated
with FLAT_BINDER_FLAG_* values, which is incorrect for an object type
of BINDER_TYPE_FD. The binder driver does not attempt to check that the
flags field is populated only with valid flag bits (and this would be
pretty difficult, since valid flag values overlap between the two
types), but it also does not do anything with these invalid flags. So
here we remove them.

Test: Cuttlefish boots successfuly
Change-Id: I1ba07855976097f7b99ea78526c933df42be68ba
parent 9c0835a8

libs/binder/Parcel.cpp

+1 −1
Original line number Original line Diff line number Diff line
@@ -1475,7 +1475,7 @@ status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership) { 
#ifdef BINDER_WITH_KERNEL_IPC

#ifdef BINDER_WITH_KERNEL_IPC

    flat_binder_object obj;

    flat_binder_object obj;

    obj.hdr.type = BINDER_TYPE_FD;

    obj.hdr.type = BINDER_TYPE_FD;

    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

    obj.flags = 0;

    obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */

    obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */

    obj.handle = fd;

    obj.handle = fd;

    obj.cookie = takeOwnership ? 1 : 0;

    obj.cookie = takeOwnership ? 1 : 0;