Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1951ce86 authored by Jeff Brown's avatar Jeff Brown
Browse files

Correctly manage the lifecycle of IME InputChannels. 

InputChannels are normally duplicated when sent to a remote process
over Binder but this does not happen if the recipient is running within
the system server process.  This causes problems for KeyGuard because the
InputMethodManagerService may accidentally dispose the channel
that KeyGuard is using.

Fixed the lifecycle of InputChannels that are managed by the IME
framework.  We now return a duplicate of the channel to the application
and then take care to dispose of the duplicate when necessary.
In particular, InputBindResult disposes its InputChannel automatically
when returned through Binder (using PARCELABLE_WRITE_RETURN_VALUE).

Bug: 8493879
Change-Id: I08ec3d13268c76f3b56706b4523508bcefa3be79
parent 41c07671

core/java/android/os/Binder.java

+9 −1
Original line number Diff line number Diff line
@@ -153,6 +153,14 @@ public class Binder implements IBinder { 
     */

    public static final native void joinThreadPool();



    /**

     * Returns true if the specified interface is a proxy.

     * @hide

     */

    public static final boolean isProxy(IInterface iface) {

        return iface.asBinder() != iface;

    }



    /**

     * Default constructor initializes the object.

     */

core/java/android/view/InputChannel.java

+11 −1
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ public final class InputChannel implements Parcelable { 
    private native void nativeTransferTo(InputChannel other);

    private native void nativeReadFromParcel(Parcel parcel);

    private native void nativeWriteToParcel(Parcel parcel);

    private native void nativeDup(InputChannel target);

    

    private native String nativeGetName();
@@ -125,6 +126,15 @@ public final class InputChannel implements Parcelable { 
        nativeTransferTo(outParameter);

    }



    /**

     * Duplicates the input channel.

     */

    public InputChannel dup() {

        InputChannel target = new InputChannel();

        nativeDup(target);

        return target;

    }



    @Override

    public int describeContents() {

        return Parcelable.CONTENTS_FILE_DESCRIPTOR;

core/java/com/android/internal/view/InputBindResult.java

+1 −1
Original line number Diff line number Diff line
@@ -84,7 +84,7 @@ public final class InputBindResult implements Parcelable { 
        dest.writeStrongInterface(method);

        if (channel != null) {

            dest.writeInt(1);

            channel.writeToParcel(dest, 0);

            channel.writeToParcel(dest, flags);

        } else {

            dest.writeInt(0);

        }

core/jni/android_view_InputChannel.cpp

+11 −0
Original line number Diff line number Diff line
@@ -246,6 +246,15 @@ static jstring android_view_InputChannel_nativeGetName(JNIEnv* env, jobject obj) 
    return name;

}



static void android_view_InputChannel_nativeDup(JNIEnv* env, jobject obj, jobject otherObj) {

    NativeInputChannel* nativeInputChannel =

            android_view_InputChannel_getNativeInputChannel(env, obj);

    if (nativeInputChannel) {

        android_view_InputChannel_setNativeInputChannel(env, otherObj,

                new NativeInputChannel(nativeInputChannel->getInputChannel()->dup()));

    }

}



// ----------------------------------------------------------------------------



static JNINativeMethod gInputChannelMethods[] = {
@@ -262,6 +271,8 @@ static JNINativeMethod gInputChannelMethods[] = { 
            (void*)android_view_InputChannel_nativeWriteToParcel },

    { "nativeGetName", "()Ljava/lang/String;",

            (void*)android_view_InputChannel_nativeGetName },

    { "nativeDup", "(Landroid/view/InputChannel;)V",

            (void*)android_view_InputChannel_nativeDup },

};



#define FIND_CLASS(var, className) \

include/androidfw/InputTransport.h

+3 −0
Original line number Diff line number Diff line
@@ -168,6 +168,9 @@ public: 
     */

    status_t receiveMessage(InputMessage* msg);



    /* Returns a new object that has a duplicate of this channel's fd. */

    sp<InputChannel> dup() const;



private:

    String8 mName;

    int mFd;