Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8fb0e194 authored by Amith Yamasani's avatar Amith Yamasani
Browse files

Fix crash in bindService due to uncleared binder identity 

Clear the calling identity in retrieveServiceLocked before
doing the appop check. It probably needs to be cleared sooner
in general in retrieveServiceLocked(), but that might be a risky
fix. Making this smaller fix to keep it surgical for now.

Bug: 25759739
Change-Id: I66a5f8ef9b2d914181925fa344c3f2962030583d
parent 06993a33

services/core/java/com/android/server/am/ActiveServices.java

+14 −9
Original line number Diff line number Diff line
@@ -1094,8 +1094,10 @@ public final class ActiveServices { 
                }

                r = smap.mServicesByName.get(name);

                if (r == null && createIfNeeded) {

                    // Before going further -- if this app is not allowed to run in the background,

                    // then at this point we aren't going to let it period.

                    final long token = Binder.clearCallingIdentity();

                    try {

                        // Before going further -- if this app is not allowed to run in the

                        // background, then at this point we aren't going to let it period.

                        if (!mAm.checkAllowBackgroundLocked(sInfo.applicationInfo.uid,

                                sInfo.packageName, callingPid)) {

                            Slog.w(TAG, "Background execution not allowed: service "
@@ -1104,6 +1106,9 @@ public final class ActiveServices { 
                                    + " pkg=" + callingPackage);

                            return null;

                        }

                    } finally {

                        Binder.restoreCallingIdentity(token);

                    }



                    Intent.FilterComparison filter

                            = new Intent.FilterComparison(service.cloneFilter());