Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2eb99915 authored by Prabir Pradhan's avatar Prabir Pradhan
Browse files

Ensure embedded window's channel is not disposed before being duped 

If the InputChannel is created inside a critical section, but then
duped to another channel after the lock is released, it's possible
the channel could be disposed (e.g. because window is removed) before
the duplication happens. To prevent this, dup the InputChannel in the
same critical section as where it was created.

Bug: 283314325
Test: Presubmit
Change-Id: I00dd3e54240512a6d2ddfe7ec40a6c4f14d837fc
parent 6bcaace5

services/core/java/com/android/server/wm/EmbeddedWindowController.java

+3 −2
Original line number Original line Diff line number Diff line
@@ -23,6 +23,7 @@ import static com.android.server.wm.WindowManagerDebugConfig.TAG_WITH_CLASS_NAME 
import static com.android.server.wm.WindowManagerDebugConfig.TAG_WM;

import static com.android.server.wm.WindowManagerDebugConfig.TAG_WM;

import static com.android.server.wm.WindowStateProto.IDENTIFIER;

import static com.android.server.wm.WindowStateProto.IDENTIFIER;





import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.Nullable;

import android.os.IBinder;

import android.os.IBinder;

import android.os.RemoteException;

import android.os.RemoteException;
@@ -217,10 +218,10 @@ class EmbeddedWindowController { 
                    mHostWindowState.mInputWindowHandle.getInputApplicationHandle());

                    mHostWindowState.mInputWindowHandle.getInputApplicationHandle());

        }

        }





        InputChannel openInputChannel() {

        void openInputChannel(@NonNull InputChannel outInputChannel) {

            final String name = toString();

            final String name = toString();

            mInputChannel = mWmService.mInputManager.createInputChannel(name);

            mInputChannel = mWmService.mInputManager.createInputChannel(name);

            return mInputChannel;

            mInputChannel.copyTo(outInputChannel);

        }

        }





        void onRemoved() {

        void onRemoved() {

services/core/java/com/android/server/wm/WindowManagerService.java

+4 −6
Original line number Original line Diff line number Diff line
@@ -8738,24 +8738,22 @@ public class WindowManagerService extends IWindowManager.Stub 
        final int sanitizedType = sanitizeWindowType(session, displayId, windowToken, type);

        final int sanitizedType = sanitizeWindowType(session, displayId, windowToken, type);

        final InputApplicationHandle applicationHandle;

        final InputApplicationHandle applicationHandle;

        final String name;

        final String name;

        final InputChannel clientChannel;

        Objects.requireNonNull(outInputChannel);

        synchronized (mGlobalLock) {

        synchronized (mGlobalLock) {

            EmbeddedWindowController.EmbeddedWindow win =

            EmbeddedWindowController.EmbeddedWindow win =

                    new EmbeddedWindowController.EmbeddedWindow(session, this, window,

                    new EmbeddedWindowController.EmbeddedWindow(session, this, window,

                            mInputToWindowMap.get(hostInputToken), callingUid, callingPid,

                            mInputToWindowMap.get(hostInputToken), callingUid, callingPid,

                            sanitizedType, displayId, focusGrantToken, inputHandleName,

                            sanitizedType, displayId, focusGrantToken, inputHandleName,

                            (flags & FLAG_NOT_FOCUSABLE) == 0);

                            (flags & FLAG_NOT_FOCUSABLE) == 0);

            clientChannel = win.openInputChannel();

            win.openInputChannel(outInputChannel);

            mEmbeddedWindowController.add(clientChannel.getToken(), win);

            mEmbeddedWindowController.add(outInputChannel.getToken(), win);

            applicationHandle = win.getApplicationHandle();

            applicationHandle = win.getApplicationHandle();

            name = win.toString();

            name = win.toString();

        }

        }





        updateInputChannel(clientChannel.getToken(), callingUid, callingPid, displayId, surface,

        updateInputChannel(outInputChannel.getToken(), callingUid, callingPid, displayId, surface,

                name, applicationHandle, flags, privateFlags, inputFeatures, sanitizedType,

                name, applicationHandle, flags, privateFlags, inputFeatures, sanitizedType,

                null /* region */, window);

                null /* region */, window);



        clientChannel.copyTo(outInputChannel);

    }

    }





    boolean transferEmbeddedTouchFocusToHost(IWindow embeddedWindow) {

    boolean transferEmbeddedTouchFocusToHost(IWindow embeddedWindow) {