Merge "Make sure caller verification is done inside a lock" (3d0f2625) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/inputmethod/InputMethodManagerService.java

+72 −75

Original line number	Diff line number	Diff line
		@@ -1617,7 +1617,8 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		// Check whether or not this is a valid IPC. Assumes an IPC is valid when either
		// 1) it comes from the system process
		// 2) the calling process' user id is identical to the current user id IMMS thinks.
		private boolean calledFromValidUser() {
		@GuardedBy("mMethodMap")
		private boolean calledFromValidUserLocked() {
		final int uid = Binder.getCallingUid();
		final int userId = UserHandle.getUserId(uid);
		if (DEBUG) {
		@@ -1699,11 +1700,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		}

		private List<InputMethodInfo> getInputMethodList(final boolean isVrOnly) {
		synchronized (mMethodMap) {
		// TODO: Make this work even for non-current users?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return Collections.emptyList();
		}
		synchronized (mMethodMap) {
		ArrayList<InputMethodInfo> methodList = new ArrayList<>();
		for (InputMethodInfo info : mMethodList) {

		@@ -1717,11 +1718,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public List<InputMethodInfo> getEnabledInputMethodList() {
		synchronized (mMethodMap) {
		// TODO: Make this work even for non-current users?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return Collections.emptyList();
		}
		synchronized (mMethodMap) {
		return mSettings.getEnabledInputMethodListLocked();
		}
		}
		@@ -1733,11 +1734,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@Override
		public List<InputMethodSubtype> getEnabledInputMethodSubtypeList(String imiId,
		boolean allowsImplicitlySelectedSubtypes) {
		synchronized (mMethodMap) {
		// TODO: Make this work even for non-current users?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return Collections.emptyList();
		}
		synchronized (mMethodMap) {
		final InputMethodInfo imi;
		if (imiId == null && mCurMethodId != null) {
		imi = mMethodMap.get(mCurMethodId);
		@@ -2449,10 +2450,10 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public void registerSuggestionSpansForNotification(SuggestionSpan[] spans) {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		synchronized (mMethodMap) {
		final InputMethodInfo currentImi = mMethodMap.get(mCurMethodId);
		for (int i = 0; i < spans.length; ++i) {
		SuggestionSpan ss = spans[i];
		@@ -2465,10 +2466,10 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public boolean notifySuggestionPicked(SuggestionSpan span, String originalString, int index) {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return false;
		}
		synchronized (mMethodMap) {
		final InputMethodInfo targetImi = mSecureSuggestionSpans.get(span);
		// TODO: Do not send the intent if the process of the targetImi is already dead.
		if (targetImi != null) {
		@@ -2632,13 +2633,13 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@Override
		public boolean showSoftInput(IInputMethodClient client, int flags,
		ResultReceiver resultReceiver) {
		if (!calledFromValidUser()) {
		int uid = Binder.getCallingUid();
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return false;
		}
		int uid = Binder.getCallingUid();
		long ident = Binder.clearCallingIdentity();
		final long ident = Binder.clearCallingIdentity();
		try {
		synchronized (mMethodMap) {
		if (mCurClient == null \|\| client == null
		\|\| mCurClient.client.asBinder() != client.asBinder()) {
		// We need to check if this is the current client with
		@@ -2656,11 +2657,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		}
		if (DEBUG) Slog.v(TAG, "Client requesting input be shown");
		return showCurrentInputLocked(flags, resultReceiver);
		}
		} finally {
		Binder.restoreCallingIdentity(ident);
		}
		}
		}

		@GuardedBy("mMethodMap")
		boolean showCurrentInputLocked(int flags, ResultReceiver resultReceiver) {
		@@ -2717,13 +2718,13 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@Override
		public boolean hideSoftInput(IInputMethodClient client, int flags,
		ResultReceiver resultReceiver) {
		if (!calledFromValidUser()) {
		int uid = Binder.getCallingUid();
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return false;
		}
		int uid = Binder.getCallingUid();
		long ident = Binder.clearCallingIdentity();
		final long ident = Binder.clearCallingIdentity();
		try {
		synchronized (mMethodMap) {
		if (mCurClient == null \|\| client == null
		\|\| mCurClient.client.asBinder() != client.asBinder()) {
		// We need to check if this is the current client with
		@@ -2744,11 +2745,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		if (DEBUG) Slog.v(TAG, "Client requesting input be hidden");
		return hideCurrentInputLocked(flags, resultReceiver);
		}
		} finally {
		Binder.restoreCallingIdentity(ident);
		}
		}
		}

		boolean hideCurrentInputLocked(int flags, ResultReceiver resultReceiver) {
		if ((flags&InputMethodManager.HIDE_IMPLICIT_ONLY) != 0
		@@ -2826,14 +2827,14 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@SoftInputModeFlags int softInputMode, int windowFlags, EditorInfo attribute,
		IInputContext inputContext, @MissingMethodFlags int missingMethods,
		int unverifiedTargetSdkVersion) {
		// Needs to check the validity before clearing calling identity
		final boolean calledFromValidUser = calledFromValidUser();
		InputBindResult res = null;
		long ident = Binder.clearCallingIdentity();
		try {
		synchronized (mMethodMap) {
		// Needs to check the validity before clearing calling identity
		final boolean calledFromValidUser = calledFromValidUserLocked();
		final int windowDisplayId =
		mWindowManagerInternal.getDisplayIdForWindow(windowToken);
		synchronized (mMethodMap) {
		final long ident = Binder.clearCallingIdentity();
		try {
		if (DEBUG) Slog.v(TAG, "startInputOrWindowGainedFocusInternal: reason="
		+ InputMethodDebug.startInputReasonToString(startInputReason)
		+ " client=" + client.asBinder()
		@@ -3022,10 +3023,10 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		res = InputBindResult.NULL_EDITOR_INFO;
		}
		}
		}
		} finally {
		Binder.restoreCallingIdentity(ident);
		}
		}

		return res;
		}
		@@ -3055,10 +3056,10 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@Override
		public void showInputMethodPickerFromClient(
		IInputMethodClient client, int auxiliarySubtypeMode) {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		synchronized (mMethodMap) {
		if(!canShowInputMethodPickerLocked(client)) {
		Slog.w(TAG, "Ignoring showInputMethodPickerFromClient of uid "
		+ Binder.getCallingUid() + ": " + client);
		@@ -3083,18 +3084,20 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public void setInputMethod(IBinder token, String id) {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		setInputMethodWithSubtypeId(token, id, NOT_A_SUBTYPE_ID);
		setInputMethodWithSubtypeIdLocked(token, id, NOT_A_SUBTYPE_ID);
		}
		}

		@Override
		public void setInputMethodAndSubtype(IBinder token, String id, InputMethodSubtype subtype) {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		synchronized (mMethodMap) {
		if (subtype != null) {
		setInputMethodWithSubtypeIdLocked(token, id,
		InputMethodUtils.getSubtypeIdFromHashCode(mMethodMap.get(id),
		@@ -3108,11 +3111,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		@Override
		public void showInputMethodAndSubtypeEnablerFromClient(
		IInputMethodClient client, String inputMethodId) {
		synchronized (mMethodMap) {
		// TODO(yukawa): Should we verify the display ID?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		synchronized (mMethodMap) {
		executeOrSendMessage(mCurMethod, mCaller.obtainMessageO(
		MSG_SHOW_IM_SUBTYPE_ENABLER, inputMethodId));
		}
		@@ -3224,10 +3227,10 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public InputMethodSubtype getLastInputMethodSubtype() {
		if (!calledFromValidUser()) {
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return null;
		}
		synchronized (mMethodMap) {
		final Pair<String, String> lastIme = mSettings.getLastInputMethodAndSubtypeLocked();
		// TODO: Handle the case of the last IME with no subtypes
		if (lastIme == null \|\| TextUtils.isEmpty(lastIme.first)
		@@ -3250,13 +3253,13 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public void setAdditionalInputMethodSubtypes(String imiId, InputMethodSubtype[] subtypes) {
		if (!calledFromValidUser()) {
		return;
		}
		// By this IPC call, only a process which shares the same uid with the IME can add
		// additional input method subtypes to the IME.
		if (TextUtils.isEmpty(imiId) \|\| subtypes == null) return;
		synchronized (mMethodMap) {
		if (!calledFromValidUserLocked()) {
		return;
		}
		if (!mSystemReady) {
		return;
		}
		@@ -3322,12 +3325,6 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		}
		}

		private void setInputMethodWithSubtypeId(IBinder token, String id, int subtypeId) {
		synchronized (mMethodMap) {
		setInputMethodWithSubtypeIdLocked(token, id, subtypeId);
		}
		}

		private void setInputMethodWithSubtypeIdLocked(IBinder token, String id, int subtypeId) {
		if (token == null) {
		if (mContext.checkCallingOrSelfPermission(
		@@ -4182,11 +4179,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub
		*/
		@Override
		public InputMethodSubtype getCurrentInputMethodSubtype() {
		synchronized (mMethodMap) {
		// TODO: Make this work even for non-current users?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return null;
		}
		synchronized (mMethodMap) {
		return getCurrentInputMethodSubtypeLocked();
		}
		}
		@@ -4261,11 +4258,11 @@ public class InputMethodManagerService extends IInputMethodManager.Stub

		@Override
		public boolean setCurrentInputMethodSubtype(InputMethodSubtype subtype) {
		synchronized (mMethodMap) {
		// TODO: Make this work even for non-current users?
		if (!calledFromValidUser()) {
		if (!calledFromValidUserLocked()) {
		return false;
		}
		synchronized (mMethodMap) {
		if (subtype != null && mCurMethodId != null) {
		InputMethodInfo imi = mMethodMap.get(mCurMethodId);
		int subtypeId = InputMethodUtils.getSubtypeIdFromHashCode(imi, subtype.hashCode());