Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7c28f94 authored by Robin Lee's avatar Robin Lee
Browse files

Add null checking for Log.wtf CrashInfo 

This is a hidden API that is only used inside RuntimeInit. When a caller
claims to be the system, ActivityManagerService can't necessarily tell
if they're being honest and assumes they are. The request is put on a
background handler to avoid locks, and the app is not supposed to be
allowed to crash.

We weren't checking well-formedness of the other arguments. A
NullPointerException on the background handler can take down the
entire system. So we should check the crashInfo for nullness before
it's used.

Test: atest FrameworksCoreTests
Bug: 171963789
Change-Id: I12341acef9b36e8d2a1af9952f9af93a5210a67a
parent 831a34a6

services/core/java/com/android/server/am/ActivityManagerService.java

+10 −5
Original line number Original line Diff line number Diff line
@@ -7736,11 +7736,15 @@ public class ActivityManagerService extends IActivityManager.Stub 
     * @return true if the process should exit immediately (WTF is fatal)

     * @return true if the process should exit immediately (WTF is fatal)

     */

     */

    @Override

    @Override

    public boolean handleApplicationWtf(final IBinder app, final String tag, boolean system,

    public boolean handleApplicationWtf(@Nullable final IBinder app, @Nullable final String tag,

            final ApplicationErrorReport.ParcelableCrashInfo crashInfo, int immediateCallerPid) {

            boolean system, @NonNull final ApplicationErrorReport.ParcelableCrashInfo crashInfo,

            int immediateCallerPid) {

        final int callingUid = Binder.getCallingUid();

        final int callingUid = Binder.getCallingUid();

        final int callingPid = Binder.getCallingPid();

        final int callingPid = Binder.getCallingPid();




















        // Internal callers in RuntimeInit should always generate a crashInfo.














        Preconditions.checkNotNull(crashInfo);
























        // If this is coming from the system, we could very well have low-level







        // If this is coming from the system, we could very well have low-level











        // system locks held, so we want to do this all asynchronously.  And we







        // system locks held, so we want to do this all asynchronously.  And we











        // never want this to become fatal, so there is that too.







        // never want this to become fatal, so there is that too.










@@ -7773,14 +7777,15 @@ public class ActivityManagerService extends IActivityManager.Stub









        }







        }











    }







    }



























    ProcessRecord handleApplicationWtfInner(int callingUid, int callingPid, IBinder app, String tag,







    ProcessRecord handleApplicationWtfInner(int callingUid, int callingPid, @Nullable IBinder app,











            final ApplicationErrorReport.CrashInfo crashInfo) {







            @Nullable String tag, @Nullable final ApplicationErrorReport.CrashInfo crashInfo) {











        final ProcessRecord r = findAppProcess(app, "WTF");







        final ProcessRecord r = findAppProcess(app, "WTF");











        final String processName = app == null ? "system_server"







        final String processName = app == null ? "system_server"











                : (r == null ? "unknown" : r.processName);







                : (r == null ? "unknown" : r.processName);



























        EventLogTags.writeAmWtf(UserHandle.getUserId(callingUid), callingPid,







        EventLogTags.writeAmWtf(UserHandle.getUserId(callingUid), callingPid,











                processName, r == null ? -1 : r.info.flags, tag, crashInfo.exceptionMessage);







                processName, r == null ? -1 : r.info.flags, tag,














                crashInfo == null ? "unknown" : crashInfo.exceptionMessage);



























        FrameworkStatsLog.write(FrameworkStatsLog.WTF_OCCURRED, callingUid, tag, processName,







        FrameworkStatsLog.write(FrameworkStatsLog.WTF_OCCURRED, callingUid, tag, processName,











                callingPid, (r != null) ? r.getProcessClassEnum() : 0);







                callingPid, (r != null) ? r.getProcessClassEnum() : 0);