Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4db79444 authored by Eric Laurent's avatar Eric Laurent
Browse files

restrict binder transactions to audioserver 

Prevent other processes from sending reserved binder transactions
to IAudioFlinger and IAudioPolicyService.

Test: Manual audio smoke tests
Test: CTS: AudioRecordTest, AudioTrackTest, AudioEffectTest,
AudioPreProcessingTest, AudioManagerTest

Change-Id: I3643e03cb056236f5e88476d0a575cc28c220f2c
parent 1b2de88f

media/libaudioclient/IAudioFlinger.cpp

+31 −4
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <stdint.h>

#include <sys/types.h>



#include <binder/IPCThreadState.h>

#include <binder/Parcel.h>



#include "IAudioFlinger.h"
@@ -836,6 +837,35 @@ IMPLEMENT_META_INTERFACE(AudioFlinger, "android.media.IAudioFlinger"); 
status_t BnAudioFlinger::onTransact(

    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)

{

    // make sure transactions reserved to AudioPolicyManager do not come from other processes

    switch (code) {

        case SET_STREAM_VOLUME:

        case SET_STREAM_MUTE:

        case SET_MODE:

        case OPEN_OUTPUT:

        case OPEN_DUPLICATE_OUTPUT:

        case CLOSE_OUTPUT:

        case SUSPEND_OUTPUT:

        case RESTORE_OUTPUT:

        case OPEN_INPUT:

        case CLOSE_INPUT:

        case INVALIDATE_STREAM:

        case SET_VOICE_VOLUME:

        case MOVE_EFFECTS:

        case LOAD_HW_MODULE:

        case LIST_AUDIO_PORTS:

        case GET_AUDIO_PORT:

        case CREATE_AUDIO_PATCH:

        case RELEASE_AUDIO_PATCH:

        case LIST_AUDIO_PATCHES:

        case SET_AUDIO_PORT_CONFIG:

            ALOGW("%s: transaction %d received from PID %d",

                  __func__, code, IPCThreadState::self()->getCallingPid());

            return INVALID_OPERATION;

        default:

            break;

    }



    // Whitelist of relevant events to trigger log merging.

    // Log merging should activate during audio activity of any kind. This are considered the

    // most relevant events.
@@ -845,12 +875,8 @@ status_t BnAudioFlinger::onTransact( 
        case CREATE_RECORD:

        case SET_MASTER_VOLUME:

        case SET_MASTER_MUTE:

        case SET_STREAM_VOLUME:

        case SET_STREAM_MUTE:

        case SET_MIC_MUTE:

        case SET_PARAMETERS:

        case OPEN_INPUT:

        case SET_VOICE_VOLUME:

        case CREATE_EFFECT:

        case SYSTEM_READY: {

            requestLogMerge();
@@ -859,6 +885,7 @@ status_t BnAudioFlinger::onTransact( 
        default:

            break;

    }



    switch (code) {

        case CREATE_TRACK: {

            CHECK_INTERFACE(IAudioFlinger, data, reply);

media/libaudioclient/IAudioPolicyService.cpp

+25 −1
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <math.h>

#include <sys/types.h>



#include <binder/IPCThreadState.h>

#include <binder/Parcel.h>



#include <media/AudioEffect.h>
@@ -831,10 +832,33 @@ IMPLEMENT_META_INTERFACE(AudioPolicyService, "android.media.IAudioPolicyService" 


// ----------------------------------------------------------------------





status_t BnAudioPolicyService::onTransact(

    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)

{

    // make sure transactions reserved to AudioFlinger do not come from other processes

    switch (code) {

        case START_OUTPUT:

        case STOP_OUTPUT:

        case RELEASE_OUTPUT:

        case GET_INPUT_FOR_ATTR:

        case START_INPUT:

        case STOP_INPUT:

        case RELEASE_INPUT:

        case GET_STRATEGY_FOR_STREAM:

        case GET_OUTPUT_FOR_EFFECT:

        case REGISTER_EFFECT:

        case UNREGISTER_EFFECT:

        case SET_EFFECT_ENABLED:

        case GET_OUTPUT_FOR_ATTR:

        case ACQUIRE_SOUNDTRIGGER_SESSION:

        case RELEASE_SOUNDTRIGGER_SESSION:

            ALOGW("%s: transaction %d received from PID %d",

                  __func__, code, IPCThreadState::self()->getCallingPid());

            return INVALID_OPERATION;

        default:

            break;

    }



    switch (code) {

        case SET_DEVICE_CONNECTION_STATE: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);