Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a15d36b0 authored by Makoto Onuki's avatar Makoto Onuki
Browse files

Don't allow dangerous operations on shared handlers 

Test: Boot, tree hugger
Fix: 235594693
Change-Id: I1c14bc2e4dd22623cecbd166ea20cd62f6a8d790
parent eff8acaa

core/java/android/os/Handler.java

+23 −4
Original line number Diff line number Diff line
@@ -230,6 +230,7 @@ public class Handler { 
        mQueue = mLooper.mQueue;

        mCallback = callback;

        mAsynchronous = async;

        mIsShared = false;

    }



    /**
@@ -253,10 +254,17 @@ public class Handler { 
     */

    @UnsupportedAppUsage

    public Handler(@NonNull Looper looper, @Nullable Callback callback, boolean async) {

        this(looper, callback, async, /* shared= */ false);

    }



    /** @hide */

    public Handler(@NonNull Looper looper, @Nullable Callback callback, boolean async,

            boolean shared) {

        mLooper = looper;

        mQueue = looper.mQueue;

        mCallback = callback;

        mAsynchronous = async;

        mIsShared = shared;

    }



    /**
@@ -778,6 +786,14 @@ public class Handler { 
        return queue.enqueueMessage(msg, uptimeMillis);

    }



    private Object disallowNullArgumentIfShared(@Nullable Object arg) {

        if (mIsShared && arg == null) {

            throw new IllegalArgumentException("Null argument disallowed for shared handler."

                    + " Consider creating your own Handler instance.");

        }

        return arg;

    }



    /**

     * Remove any pending posts of messages with code 'what' that are in the

     * message queue.
@@ -792,7 +808,7 @@ public class Handler { 
     * all messages will be removed.

     */

    public final void removeMessages(int what, @Nullable Object object) {

        mQueue.removeMessages(this, what, object);

        mQueue.removeMessages(this, what, disallowNullArgumentIfShared(object));

    }



    /**
@@ -807,7 +823,7 @@ public class Handler { 
     *@hide

     */

    public final void removeEqualMessages(int what, @Nullable Object object) {

        mQueue.removeEqualMessages(this, what, object);

        mQueue.removeEqualMessages(this, what, disallowNullArgumentIfShared(object));

    }



    /**
@@ -816,7 +832,7 @@ public class Handler { 
     * all callbacks and messages will be removed.

     */

    public final void removeCallbacksAndMessages(@Nullable Object token) {

        mQueue.removeCallbacksAndMessages(this, token);

        mQueue.removeCallbacksAndMessages(this, disallowNullArgumentIfShared(token));

    }



    /**
@@ -827,7 +843,7 @@ public class Handler { 
     *@hide

     */

    public final void removeCallbacksAndEqualMessages(@Nullable Object token) {

        mQueue.removeCallbacksAndEqualMessages(this, token);

        mQueue.removeCallbacksAndEqualMessages(this, disallowNullArgumentIfShared(token));

    }

    /**

     * Check if there are any pending posts of messages with code 'what' in
@@ -951,6 +967,9 @@ public class Handler { 
    @UnsupportedAppUsage

    IMessenger mMessenger;



    /** If it's a shared handler, we disallow certain dangeraous operations. */

    private final boolean mIsShared;



    private static final class BlockingRunnable implements Runnable {

        private final Runnable mTask;

        private boolean mDone;

core/java/com/android/internal/os/BackgroundThread.java

+2 −1
Original line number Diff line number Diff line
@@ -46,7 +46,8 @@ public final class BackgroundThread extends HandlerThread { 
            looper.setTraceTag(Trace.TRACE_TAG_SYSTEM_SERVER);

            looper.setSlowLogThresholdMs(

                    SLOW_DISPATCH_THRESHOLD_MS, SLOW_DELIVERY_THRESHOLD_MS);

            sHandler = new Handler(sInstance.getLooper());

            sHandler = new Handler(sInstance.getLooper(), /*callback=*/ null, /* async=*/ false,

                    /* shared=*/ true);

            sHandlerExecutor = new HandlerExecutor(sHandler);

        }

    }

services/core/java/com/android/server/DisplayThread.java

+1 −1
Original line number Diff line number Diff line
@@ -43,7 +43,7 @@ public final class DisplayThread extends ServiceThread { 
            sInstance = new DisplayThread();

            sInstance.start();

            sInstance.getLooper().setTraceTag(Trace.TRACE_TAG_SYSTEM_SERVER);

            sHandler = new Handler(sInstance.getLooper());

            sHandler = makeSharedHandler(sInstance.getLooper());

        }

    }

services/core/java/com/android/server/FgThread.java

+1 −1
Original line number Diff line number Diff line
@@ -51,7 +51,7 @@ public final class FgThread extends ServiceThread { 
            looper.setTraceTag(Trace.TRACE_TAG_SYSTEM_SERVER);

            looper.setSlowLogThresholdMs(

                    SLOW_DISPATCH_THRESHOLD_MS, SLOW_DELIVERY_THRESHOLD_MS);

            sHandler = new Handler(sInstance.getLooper());

            sHandler = makeSharedHandler(sInstance.getLooper());

            sHandlerExecutor = new HandlerExecutor(sHandler);

        }

    }

services/core/java/com/android/server/IoThread.java

+1 −1
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ public final class IoThread extends ServiceThread { 
            sInstance = new IoThread();

            sInstance.start();

            sInstance.getLooper().setTraceTag(Trace.TRACE_TAG_SYSTEM_SERVER);

            sHandler = new Handler(sInstance.getLooper());

            sHandler = makeSharedHandler(sInstance.getLooper());

            sHandlerExecutor = new HandlerExecutor(sHandler);

        }

    }