Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93b4f30a authored by Jeff Hamilton's avatar Jeff Hamilton
Browse files

Use token instead of Intent for bound services. 

Don't trust that apps will return an Intent that
is formed properly, and rely on the
IntentBindRecord instead to track internally.

Bug: 388387024
Flag: EXEMPT AIDL change, which cannot be flagged
Test: atest FrameworksServicesTests_presubmit, device boots and runs
Change-Id: I500792d9d685c2de853ff96e2d34d57b17897fae
parent 37af29e4

core/java/android/app/ActivityThread.java

+18 −12
Original line number Diff line number Diff line
@@ -935,11 +935,14 @@ public final class ActivityThread extends ClientTransactionHandler 
        @UnsupportedAppUsage

        IBinder token;

        @UnsupportedAppUsage

        IBinder bindToken;

        @UnsupportedAppUsage

        Intent intent;

        boolean rebind;

        long bindSeq;

        public String toString() {

            return "BindServiceData{token=" + token + " intent=" + intent

                    + " bindToken = " + bindToken

                    + " bindSeq=" + bindSeq + "}";

        }

    }
@@ -1215,18 +1218,20 @@ public final class ActivityThread extends ClientTransactionHandler 
            sendMessage(H.CREATE_SERVICE, s);

        }



        public final void scheduleBindService(IBinder token, Intent intent,

        public final void scheduleBindService(IBinder token, IBinder bindToken, Intent intent,

                boolean rebind, int processState, long bindSeq) {

            updateProcessState(processState, false);

            BindServiceData s = new BindServiceData();

            s.token = token;

            s.bindToken = bindToken;

            s.intent = intent;

            s.rebind = rebind;

            s.bindSeq = bindSeq;



            if (DEBUG_SERVICE)

                Slog.v(TAG, "scheduleBindService token=" + token + " intent=" + intent + " uid="

                        + Binder.getCallingUid() + " pid=" + Binder.getCallingPid());

                Slog.v(TAG, "scheduleBindService token=" + token + " bindToken=" + bindToken

                        + " intent=" + intent + " uid=" + Binder.getCallingUid()

                        + " pid=" + Binder.getCallingPid());



            if (Trace.isTagEnabled(Trace.TRACE_TAG_ACTIVITY_MANAGER)) {

                Trace.instant(Trace.TRACE_TAG_ACTIVITY_MANAGER, "scheduleBindService. token="
@@ -1235,9 +1240,10 @@ public final class ActivityThread extends ClientTransactionHandler 
            sendMessage(H.BIND_SERVICE, s);

        }



        public final void scheduleUnbindService(IBinder token, Intent intent) {

        public final void scheduleUnbindService(IBinder token, IBinder bindToken, Intent intent) {

            BindServiceData s = new BindServiceData();

            s.token = token;

            s.bindToken = bindToken;

            s.intent = intent;

            s.bindSeq = -1;
@@ -5284,7 +5290,7 @@ public final class ActivityThread extends ClientTransactionHandler 
            mServices.put(data.token, service);

            try {

                ActivityManager.getService().serviceDoneExecuting(

                        data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0, null);

                        data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);

            } catch (RemoteException e) {

                throw e.rethrowFromSystemServer();

            }
@@ -5311,11 +5317,11 @@ public final class ActivityThread extends ClientTransactionHandler 
                    if (!data.rebind) {

                        IBinder binder = s.onBind(data.intent);

                        ActivityManager.getService().publishService(

                                data.token, data.intent, binder);

                                data.token, data.bindToken, binder);

                    } else {

                        s.onRebind(data.intent);

                        ActivityManager.getService().serviceDoneExecuting(

                                data.token, SERVICE_DONE_EXECUTING_REBIND, 0, 0, data.intent);

                                data.token, SERVICE_DONE_EXECUTING_REBIND, 0, 0);

                    }

                } catch (RemoteException ex) {

                    throw ex.rethrowFromSystemServer();
@@ -5342,10 +5348,10 @@ public final class ActivityThread extends ClientTransactionHandler 
                try {

                    if (doRebind) {

                        ActivityManager.getService().unbindFinished(

                                data.token, data.intent);

                                data.token, data.bindToken);

                    } else {

                        ActivityManager.getService().serviceDoneExecuting(

                                data.token, SERVICE_DONE_EXECUTING_UNBIND, 0, 0, data.intent);

                                data.token, SERVICE_DONE_EXECUTING_UNBIND, 0, 0);

                    }

                } catch (RemoteException ex) {

                    throw ex.rethrowFromSystemServer();
@@ -5459,8 +5465,8 @@ public final class ActivityThread extends ClientTransactionHandler 
                QueuedWork.waitToFinish();



                try {

                    ActivityManager.getService().serviceDoneExecuting(

                            data.token, SERVICE_DONE_EXECUTING_START, data.startId, res, null);

                    ActivityManager.getService().serviceDoneExecuting(data.token,

                            SERVICE_DONE_EXECUTING_START, data.startId, res);

                } catch (RemoteException e) {

                    throw e.rethrowFromSystemServer();

                }
@@ -5492,7 +5498,7 @@ public final class ActivityThread extends ClientTransactionHandler 


                try {

                    ActivityManager.getService().serviceDoneExecuting(

                            token, SERVICE_DONE_EXECUTING_STOP, 0, 0, null);

                            token, SERVICE_DONE_EXECUTING_STOP, 0, 0);

                } catch (RemoteException e) {

                    throw e.rethrowFromSystemServer();

                }

core/java/android/app/IActivityManager.aidl

+3 −4
Original line number Diff line number Diff line
@@ -235,7 +235,7 @@ interface IActivityManager { 
    void updateServiceGroup(in IServiceConnection connection, int group, int importance);

    @UnsupportedAppUsage

    boolean unbindService(in IServiceConnection connection);

    void publishService(in IBinder token, in Intent intent, in IBinder service);

    void publishService(in IBinder token, in IBinder bindToken, in IBinder service);

    @UnsupportedAppUsage(maxTargetSdk = 30, trackingBug = 170729553)

    void setDebugApp(in String packageName, boolean waitForDebugger, boolean persistent);

    void setAgentApp(in String packageName, @nullable String agent);
@@ -301,8 +301,7 @@ interface IActivityManager { 
    @UnsupportedAppUsage

    ParceledListSlice getRecentTasks(int maxNum, int flags, int userId);

    @UnsupportedAppUsage

    oneway void serviceDoneExecuting(in IBinder token, int type, int startId, int res,

            in Intent intent);

    oneway void serviceDoneExecuting(in IBinder token, int type, int startId, int res);

    /** @deprecated  Use {@link #getIntentSenderWithFeature} instead */

    @UnsupportedAppUsage(maxTargetSdk=29, publicAlternatives="Use {@link PendingIntent#getIntentSender()} instead")

    IIntentSender getIntentSender(int type, in String packageName, in IBinder token,
@@ -328,7 +327,7 @@ interface IActivityManager { 
    oneway void removeContentProvider(in IBinder connection, boolean stable);

    @UnsupportedAppUsage

    void setRequestedOrientation(in IBinder token, int requestedOrientation);

    void unbindFinished(in IBinder token, in Intent service);

    void unbindFinished(in IBinder token, in IBinder bindToken);

    @UnsupportedAppUsage

    void setProcessImportant(in IBinder token, int pid, boolean isForeground, String reason);

    void setServiceForeground(in ComponentName className, in IBinder token,

core/java/android/app/IApplicationThread.aidl

+2 −2
Original line number Diff line number Diff line
@@ -102,10 +102,10 @@ oneway interface IApplicationThread { 
    void updateTimeZone();

    void processInBackground();

    @UnsupportedAppUsage

    void scheduleBindService(IBinder token,

    void scheduleBindService(IBinder token, IBinder bindToken,

            in Intent intent, boolean rebind, int processState, long bindSeq);

    @UnsupportedAppUsage

    void scheduleUnbindService(IBinder token,

    void scheduleUnbindService(IBinder token, IBinder bindToken,

            in Intent intent);

    void dumpService(in ParcelFileDescriptor fd, IBinder servicetoken,

            in String[] args);

services/core/java/com/android/server/am/ActiveServices.java

+17 −22
Original line number Diff line number Diff line
@@ -4467,15 +4467,12 @@ public final class ActiveServices { 
                .write();

    }



    void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {

    void publishServiceLocked(ServiceRecord r, IntentBindRecord b, IBinder service) {

        final long origId = mAm.mInjector.clearCallingIdentity();

        try {

            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "PUBLISHING " + r

                    + " " + intent + ": " + service);

                    + " " + b.intent.getIntent() + ": " + service);

            if (r != null) {

                Intent.FilterComparison filter

                        = new Intent.FilterComparison(intent);

                IntentBindRecord b = r.bindings.get(filter);

                if (b != null && !b.received) {

                    b.binder = service;

                    b.requested = true;
@@ -4485,13 +4482,13 @@ public final class ActiveServices { 
                        ArrayList<ConnectionRecord> clist = connections.valueAt(conni);

                        for (int i=0; i<clist.size(); i++) {

                            ConnectionRecord c = clist.get(i);

                            if (!filter.equals(c.binding.intent.intent)) {

                            if (!b.intent.equals(c.binding.intent.intent)) {

                                if (DEBUG_SERVICE) Slog.v(

                                        TAG_SERVICE, "Not publishing to: " + c);

                                if (DEBUG_SERVICE) Slog.v(

                                        TAG_SERVICE, "Bound intent: " + c.binding.intent.intent);

                                if (DEBUG_SERVICE) Slog.v(

                                        TAG_SERVICE, "Published intent: " + intent);

                                        TAG_SERVICE, "Published intent: " + b.intent.getIntent());

                                continue;

                            }

                            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Publishing to: " + c);
@@ -4622,13 +4619,10 @@ public final class ActiveServices { 
        return true;

    }



    void unbindFinishedLocked(ServiceRecord r, Intent intent) {

    void unbindFinishedLocked(ServiceRecord r, IntentBindRecord b) {

        final long origId = mAm.mInjector.clearCallingIdentity();

        try {

            if (r != null) {

                Intent.FilterComparison filter

                        = new Intent.FilterComparison(intent);

                IntentBindRecord b = r.bindings.get(filter);

                if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "unbindFinished in " + r

                        + " at " + b + ": apps="

                        + (b != null ? b.apps.size() : 0));
@@ -5230,7 +5224,7 @@ public final class ActiveServices { 
        r.executingStart = SystemClock.uptimeMillis();

    }



    private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,

    private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord b,

            boolean execInFg, boolean rebind,

            @ServiceBindingOomAdjPolicy int serviceBindingOomAdjPolicy)

            throws TransactionTooLargeException {
@@ -5238,26 +5232,26 @@ public final class ActiveServices { 
            // If service is not currently running, can't yet bind.

            return false;

        }

        if (DEBUG_SERVICE) Slog.d(TAG_SERVICE, "requestBind " + i + ": requested=" + i.requested

        if (DEBUG_SERVICE) Slog.d(TAG_SERVICE, "requestBind " + b + ": requested=" + b.requested

                + " rebind=" + rebind);

        final boolean skipOomAdj = (serviceBindingOomAdjPolicy

                & SERVICE_BIND_OOMADJ_POLICY_SKIP_OOM_UPDATE_ON_BIND) != 0;

        if ((!i.requested || rebind) && i.apps.size() > 0) {

        if ((!b.requested || rebind) && b.apps.size() > 0) {

            try {

                bumpServiceExecutingLocked(r, execInFg, "bind",

                        skipOomAdj ? OOM_ADJ_REASON_NONE : OOM_ADJ_REASON_BIND_SERVICE,

                        skipOomAdj /* skipTimeoutIfPossible */);

                if (Trace.isTagEnabled(Trace.TRACE_TAG_ACTIVITY_MANAGER)) {

                    Trace.instant(Trace.TRACE_TAG_ACTIVITY_MANAGER, "requestServiceBinding="

                            + i.intent.getIntent() + ". bindSeq=" + mBindServiceSeqCounter);

                            + b.intent.getIntent() + ". bindSeq=" + mBindServiceSeqCounter);

                }

                r.app.getThread().scheduleBindService(r, i.intent.getIntent(), rebind,

                r.app.getThread().scheduleBindService(r, b, b.intent.getIntent(), rebind,

                        r.app.mState.getReportedProcState(), mBindServiceSeqCounter++);

                if (!rebind) {

                    i.requested = true;

                    b.requested = true;

                }

                i.hasBound = true;

                i.doRebind = false;

                b.hasBound = true;

                b.doRebind = false;

            } catch (TransactionTooLargeException e) {

                // Keep the executeNesting count accurate.

                if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Crashed while binding " + r, e);
@@ -6349,7 +6343,7 @@ public final class ActiveServices { 
                        oomAdjusted |= r.wasOomAdjUpdated();

                        ibr.hasBound = false;

                        ibr.requested = false;

                        r.app.getThread().scheduleUnbindService(r,

                        r.app.getThread().scheduleUnbindService(r, ibr,

                                ibr.intent.getIntent());

                    } catch (Exception e) {

                        Slog.w(TAG, "Exception when unbinding service "
@@ -6674,7 +6668,8 @@ public final class ActiveServices { 
                    // Assume the client doesn't want to know about a rebind;

                    // we will deal with that later if it asks for one.

                    b.intent.doRebind = false;

                    s.app.getThread().scheduleUnbindService(s, b.intent.intent.getIntent());

                    s.app.getThread().scheduleUnbindService(s, b.intent,

                            b.intent.intent.getIntent());

                } catch (Exception e) {

                    Slog.w(TAG, "Exception when unbinding service " + s.shortInstanceName, e);

                    serviceProcessGoneLocked(s, enqueueOomAdj);
@@ -6707,7 +6702,7 @@ public final class ActiveServices { 
    }



    void serviceDoneExecutingLocked(ServiceRecord r, int type, int startId, int res,

            boolean enqueueOomAdj, Intent intent) {

            boolean enqueueOomAdj) {

        boolean inDestroying = mDestroyingServices.contains(r);

        if (r != null) {

            boolean skipOomAdj = false;

services/core/java/com/android/server/am/ActivityManagerService.java

+19 −16
Original line number Diff line number Diff line
@@ -14025,40 +14025,43 @@ public class ActivityManagerService extends IActivityManager.Stub 
        }

    }













    public void publishService(IBinder token, Intent intent, IBinder service) {













        // Refuse possible leaked file descriptors













        if (intent != null && intent.hasFileDescriptors() == true) {













            throw new IllegalArgumentException("File descriptors passed in Intent");













    public void publishService(IBinder token, IBinder bindToken, IBinder service) {













        if (!(token instanceof ServiceRecord)) {













            throw new IllegalArgumentException("Invalid service token");













        }

























        if (!(bindToken instanceof IntentBindRecord)) {













            throw new IllegalArgumentException("Invalid intent bind record");















        }





























        synchronized(this) {













            if (!(token instanceof ServiceRecord)) {













                throw new IllegalArgumentException("Invalid service token");













            mServices.publishServiceLocked((ServiceRecord) token, (IntentBindRecord) bindToken,













                    service);















        }













            mServices.publishServiceLocked((ServiceRecord)token, intent, service);















    }

























    public void unbindFinished(IBinder token, IBinder bindToken) {













        if (!(token instanceof ServiceRecord)) {













            throw new IllegalArgumentException("Invalid service token");















        }



























    public void unbindFinished(IBinder token, Intent intent) {













        // Refuse possible leaked file descriptors













        if (intent != null && intent.hasFileDescriptors() == true) {













            throw new IllegalArgumentException("File descriptors passed in Intent");













        if (!(bindToken instanceof IntentBindRecord)) {













            throw new IllegalArgumentException("Invalid intent bind record");















        }





























        synchronized(this) {













            mServices.unbindFinishedLocked((ServiceRecord)token, intent);













            mServices.unbindFinishedLocked((ServiceRecord) token, (IntentBindRecord) bindToken);















        }















    }





























    @Override













    public void serviceDoneExecuting(IBinder token, int type, int startId, int res, Intent intent) {













    public void serviceDoneExecuting(IBinder token, int type, int startId, int res) {















        synchronized(this) {















            if (!(token instanceof ServiceRecord)) {















                Slog.e(TAG, "serviceDoneExecuting: Invalid service token=" + token);















                throw new IllegalArgumentException("Invalid service token");















            }













            mServices.serviceDoneExecutingLocked((ServiceRecord) token, type, startId, res, false,













                    intent);













            mServices.serviceDoneExecutingLocked((ServiceRecord) token, type, startId, res, false);















        }















    }