Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0cd8f186 authored by Riddle Hsu's avatar Riddle Hsu Committed by syphyr
Browse files

RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo 

Originally, if the caller of navigateUpTo is alive, even the calling
uid is set to the caller who launched the existing destination activity,
the uid from caller process has higher priority to replace the given
calling uid. So this change doesn't modify the existing behavior if
the caller process is valid. Besides, the case of delivering new intent
uses the source record as calling identity too, so the case of starting
new activity should be consistent.

Also forbid attaching null application thread to avoid unexpected state
in process record.

Bug: 144285917
Test: bit FrameworksServicesTests:ActivityStackTests
Test: bit CtsSecurityTestCases:ActivityManagerTest# \
      testActivityManager_attachNullApplication
Merged-In: I60732f430256d37cb926d08d093581f051c4afed
Change-Id: I60732f430256d37cb926d08d093581f051c4afed
(cherry picked from commit 1c9bf5cc)
parent db8d9ce6

services/core/java/com/android/server/am/ActivityManagerService.java

+4 −1
Original line number Diff line number Diff line
@@ -6639,7 +6639,7 @@ public final class ActivityManagerService extends ActivityManagerNative 
        }

    }













    private final boolean attachApplicationLocked(IApplicationThread thread,













    private boolean attachApplicationLocked(@NonNull IApplicationThread thread,















            int pid) {





























        // Find the application record that is being attached...  either via










@@ -6887,6 +6887,9 @@ public final class ActivityManagerService extends ActivityManagerNative



























    @Override















    public final void attachApplication(IApplicationThread thread) {













        if (thread == null) {













            throw new SecurityException("Invalid application interface");













        }















        synchronized (this) {















            int callingPid = Binder.getCallingPid();















            final long origId = Binder.clearCallingIdentity();

































services/core/java/com/android/server/am/ActivityStack.java



+5
−0




























Original line number
Diff line number
Diff line








@@ -3738,6 +3738,11 @@ final class ActivityStack {





























    final boolean navigateUpToLocked(ActivityRecord srec, Intent destIntent, int resultCode,















            Intent resultData) {













        if (srec.app == null || srec.app.thread == null) {













            // Nothing to do if the caller is not attached, because this method should be called













            // from an alive activity.













            return false;













        }















        final TaskRecord task = srec.task;















        final ArrayList<ActivityRecord> activities = task.mActivities;















        final int start = activities.indexOf(srec);