Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1272e67d authored by wilsonshih's avatar wilsonshih
Browse files

Remove task snapshot once the task is move to front. 

So it is impossible for any caller to obtain an outdated snapshot,
which may be the cause of vulnerability.

Bug: 305882849
Test: atest TaskSnapshotPersisterLoaderTest
Test: monitor snapshot file will be deleted after task move to front
Change-Id: I5256fe0f8b6a68a82b269a534d0700c8d5dead09
parent 4bb1c57a

services/core/java/com/android/server/wm/ActivitySnapshotController.java

+1 −1
Original line number Diff line number Diff line
@@ -539,7 +539,7 @@ class ActivitySnapshotController extends AbsAppSnapshotController<ActivityRecord 
        if (usf != null) {

            mUserSavedFiles.get(userId).remove(code);

            mSavedFilesInOrder.remove(usf);

            mPersister.removeSnap(code, userId);

            mPersister.removeSnapshot(code, userId);

        }

    }

services/core/java/com/android/server/wm/BaseAppSnapshotPersister.java

+1 −1
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ class BaseAppSnapshotPersister { 
     * @param id The id of task that has been removed.

     * @param userId The id of the user the task belonged to.

     */

    void removeSnap(int id, int userId) {

    void removeSnapshot(int id, int userId) {

        synchronized (mLock) {

            mSnapshotPersistQueue.sendToQueueLocked(mSnapshotPersistQueue

                    .createDeleteWriteQueueItem(id, userId, mPersistInfoProvider));

services/core/java/com/android/server/wm/SnapshotController.java

+13 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ import static android.view.WindowManager.TRANSIT_TO_FRONT; 


import android.os.Trace;

import android.view.WindowManager;

import android.window.TaskSnapshot;



import java.io.PrintWriter;

import java.util.ArrayList;
@@ -126,6 +127,18 @@ class SnapshotController { 
        }

        mActivitySnapshotController.handleTransitionFinish(windows);

        mActivitySnapshotController.endSnapshotProcess();

        // Remove task snapshot if it is visible at the end of transition.

        for (int i = changeInfos.size() - 1; i >= 0; --i) {

            final WindowContainer wc = changeInfos.get(i).mContainer;

            final Task task = wc.asTask();

            if (task != null && wc.isVisibleRequested()) {

                final TaskSnapshot snapshot = mTaskSnapshotController.getSnapshot(task.mTaskId,

                        task.mUserId, false /* restoreFromDisk */, false /* isLowResolution */);

                if (snapshot != null) {

                    mTaskSnapshotController.removeAndDeleteSnapshot(task.mTaskId, task.mUserId);

                }

            }

        }

        Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);

    }

services/core/java/com/android/server/wm/Task.java

+1 −1
Original line number Diff line number Diff line
@@ -1333,7 +1333,7 @@ class Task extends TaskFragment { 


        clearRootProcess();



        mAtmService.mWindowManager.mTaskSnapshotController.notifyTaskRemovedFromRecents(

        mAtmService.mWindowManager.mTaskSnapshotController.removeAndDeleteSnapshot(

                mTaskId, mUserId);

    }

services/core/java/com/android/server/wm/TaskSnapshotController.java

+2 −2
Original line number Diff line number Diff line
@@ -284,9 +284,9 @@ class TaskSnapshotController extends AbsAppSnapshotController<Task, TaskSnapshot 
        }

    }



    void notifyTaskRemovedFromRecents(int taskId, int userId) {

    void removeAndDeleteSnapshot(int taskId, int userId) {

        mCache.onIdRemoved(taskId);

        mPersister.onTaskRemovedFromRecents(taskId, userId);

        mPersister.removeSnapshot(taskId, userId);

    }



    void removeSnapshotCache(int taskId) {