Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb1c29d6 authored by Steven Moreland's avatar Steven Moreland Committed by Android (Google) Code Review
Browse files

Merge changes from topic "revert-1553275-Bug139327211_V5-QZELUAZXGW" into sc-dev 

* changes:
  Revert "binder: race condition by parcel finalize"
  Revert "libbinder: test parcel allocted on another thread"
parents c8451025 58c1098c

libs/binder/IPCThreadState.cpp

+0 −6
Original line number Diff line number Diff line
@@ -614,12 +614,6 @@ void IPCThreadState::processPostWriteDerefs() 
    mPostWriteStrongDerefs.clear();

}



void IPCThreadState::createTransactionReference(RefBase* ref)

{

    ref->incStrong(mProcess.get());

    mPostWriteStrongDerefs.push(ref);

}



void IPCThreadState::joinThreadPool(bool isMain)

{

    LOG_THREADPOOL("**** THREAD %p (PID %d) IS JOINING THE THREAD POOL\n", (void*)pthread_self(), getpid());

libs/binder/include/binder/IPCThreadState.h

+0 −6
Original line number Diff line number Diff line
@@ -162,12 +162,6 @@ public: 
            // This constant needs to be kept in sync with Binder.UNSET_WORKSOURCE from the Java

            // side.

            static const int32_t kUnsetWorkSource = -1;



            // Create a temp reference until commands in queue flushed to driver

            // Internal only.

            // @internal

            void                 createTransactionReference(RefBase* ref);



private:

                                IPCThreadState();

                                ~IPCThreadState();

libs/binder/include/binder/ParcelRef.h

deleted100644 → 0
+0 −43
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#pragma once





#include <binder/Parcel.h>

#include <utils/RefBase.h>



// ---------------------------------------------------------------------------

namespace android {



/**

 * internal use only

 * @internal

 */

class ParcelRef : public Parcel, public RefBase

{

public:

    static sp<ParcelRef> create() {

        return new ParcelRef();

    }



private:

    ParcelRef() = default;

};



} // namespace android



// ---------------------------------------------------------------------------
 
 No newline at end of file

libs/binder/tests/binderLibTest.cpp

+0 −31
Original line number Diff line number Diff line
@@ -30,7 +30,6 @@ 
#include <binder/IBinder.h>

#include <binder/IPCThreadState.h>

#include <binder/IServiceManager.h>

#include <binder/ParcelRef.h>



#include <linux/sched.h>

#include <sys/epoll.h>
@@ -891,36 +890,6 @@ TEST_F(BinderLibTest, FreedBinder) { 
    }

}



TEST_F(BinderLibTest, ParcelAllocatedOnAnotherThread) {

    sp<IBinder> server = addServer();

    ASSERT_TRUE(server != nullptr);



    Parcel data;

    sp<ParcelRef> reply = ParcelRef::create();



    // when we have a Parcel which is deleted on another thread, if it gets

    // deleted, it will tell the kernel this, and it will drop strong references

    // to binder, so that we can't BR_ACQUIRE would fail

    IPCThreadState::self()->createTransactionReference(reply.get());

    ASSERT_EQ(NO_ERROR, server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION,

                                         data,

                                         reply.get()));



    // we have sp to binder, but it is not actually acquired by kernel, the

    // transaction is sitting on an out buffer

    sp<IBinder> binder = reply->readStrongBinder();



    std::thread([&] {

        // without the transaction reference, this would cause the Parcel to be

        // deallocated before the first thread flushes BR_ACQUIRE

        reply = nullptr;

        IPCThreadState::self()->flushCommands();

    }).join();



    ASSERT_NE(nullptr, binder);

    ASSERT_EQ(NO_ERROR, binder->pingBinder());

}



TEST_F(BinderLibTest, CheckNoHeaderMappedInUser) {

    Parcel data, reply;

    sp<BinderLibTestCallBack> callBack = new BinderLibTestCallBack();