Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb9e7673 authored by Robin Lee's avatar Robin Lee
Browse files

Update LightsService linkToDeath to avoid capture 

Capturing the IBinder can keep the refcount of the object
above zero in the System Server if the Binder owner never
goes away.

Test: N/A
Flag: EXEMPT bugfix
Bug: 366432991
Change-Id: I4ab725ed93313e245ba8fbe9a0eafd48c16fba51
parent caefa535

services/core/java/com/android/server/lights/LightsService.java

+41 −27
Original line number Diff line number Diff line
@@ -67,39 +67,28 @@ public class LightsService extends SystemService { 


    private Handler mH;



    private final class LightsManagerBinderService extends ILightsManager.Stub {

        LightsManagerBinderService() {

            super(PermissionEnforcer.fromContext(getContext()));

        }

    private final class LightsManagerBinderService extends ILightsManager.Stub

          implements IBinder.DeathRecipient {



        private final class Session implements Comparable<Session> {

            final IBinder mToken;

            final SparseArray<LightState> mRequests = new SparseArray<>();

            final int mPriority;

        @GuardedBy("LightsService.this")

        private final List<Session> mSessions = new ArrayList<>();



            Session(IBinder token, int priority) {

                mToken = token;

                mPriority = priority;

        LightsManagerBinderService() {

            super(PermissionEnforcer.fromContext(getContext()));

        }



            void setRequest(int lightId, LightState state) {

                if (state != null) {

                    mRequests.put(lightId, state);

                } else {

                    mRequests.remove(lightId);

                }

            }

        /** @see #binderDied(IBinder) */

        @Override

        public void binderDied() {}



        /**

         * Callback for sessions which died without explicitly closing.

         */

        @Override

            public int compareTo(Session otherSession) {

                // Sort descending by priority

                return Integer.compare(otherSession.mPriority, mPriority);

            }

        public void binderDied(IBinder token) {

            closeSessionInternal(token);

        }



        @GuardedBy("LightsService.this")

        private final List<Session> mSessions = new ArrayList<>();



        /**

         * Returns the lights available for apps to control on the device. Only lights that aren't

         * reserved for system use are available to apps.
@@ -170,7 +159,7 @@ public class LightsService extends SystemService { 
            synchronized (LightsService.this) {

                Preconditions.checkState(getSessionLocked(token) == null, "already registered");

                try {

                    token.linkToDeath(() -> closeSessionInternal(token), 0);

                    token.linkToDeath(LightsManagerBinderService.this, 0);

                    mSessions.add(new Session(token, priority));

                    Collections.sort(mSessions);

                } catch (RemoteException e) {
@@ -270,6 +259,31 @@ public class LightsService extends SystemService { 
            }

            return null;

        }



        private final class Session implements Comparable<Session> {

            final IBinder mToken;

            final SparseArray<LightState> mRequests = new SparseArray<>();

            final int mPriority;



            Session(IBinder token, int priority) {

                mToken = token;

                mPriority = priority;

            }



            void setRequest(int lightId, LightState state) {

                if (state != null) {

                    mRequests.put(lightId, state);

                } else {

                    mRequests.remove(lightId);

                }

            }



            @Override

            public int compareTo(Session otherSession) {

                // Sort descending by priority

                return Integer.compare(otherSession.mPriority, mPriority);

            }

        }

    }



    private final class LightImpl extends LogicalLight {