Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 393aa435 authored by Mark Salyzyn's avatar Mark Salyzyn Committed by Alain Vongsouvanh
Browse files

system_server BINDER_TYPE_FD sockets using ashmem accessors 

check if device is a character device, before calling
ashmem_get_size_region. We do not check if the st_rdev
matches /dev/ashmem. So this at least eliminates making
this call when associated with a socket.

Bug: 26374183
Change-Id: I68ed9d1c2cd4c47228ed065e3e18eb4151f038f4
(cherry picked from AOSP commit eab2afc7)
parent 9cc62e87

libs/binder/Parcel.cpp

+14 −5
Original line number Diff line number Diff line
@@ -23,6 +23,9 @@ 
#include <stdio.h>

#include <stdlib.h>

#include <sys/mman.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <unistd.h>



#include <binder/Binder.h>

#include <binder/BpBinder.h>
@@ -122,8 +125,10 @@ void acquire_object(const sp<ProcessState>& proc, 
            return;

        }

        case BINDER_TYPE_FD: {

            if (obj.cookie != 0) {

                if (outAshmemSize != NULL) {

            if ((obj.cookie != 0) && (outAshmemSize != NULL)) {

                struct stat st;

                int ret = fstat(obj.handle, &st);

                if (!ret && S_ISCHR(st.st_mode)) {

                    // If we own an ashmem fd, keep track of how much memory it refers to.

                    int size = ashmem_get_size_region(obj.handle);

                    if (size > 0) {
@@ -174,11 +179,15 @@ static void release_object(const sp<ProcessState>& proc, 
        case BINDER_TYPE_FD: {

            if (obj.cookie != 0) { // owned

                if (outAshmemSize != NULL) {

                    struct stat st;

                    int ret = fstat(obj.handle, &st);

                    if (!ret && S_ISCHR(st.st_mode)) {

                        int size = ashmem_get_size_region(obj.handle);

                        if (size > 0) {

                            *outAshmemSize -= size;

                        }

                    }

                }



                close(obj.handle);

            }