Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5e917950 authored by Mark Salyzyn's avatar Mark Salyzyn Committed by android-build-merger
Browse files

Merge "svcmgr: don\'t send reply to one-way txn (part deux)" into nyc-dev 

am: e4ecdb66

* commit 'e4ecdb66':
  svcmgr: don't send reply to one-way txn (part deux)

Change-Id: Id062b1b3998ab018654bc7830f275d1ac6d64f6d
parents 61f0597f e4ecdb66

cmds/servicemanager/binder.c

+10 −3
Original line number Original line Diff line number Diff line
@@ -181,13 +181,18 @@ void binder_free_buffer(struct binder_state *bs, 




void binder_send_reply(struct binder_state *bs,

void binder_send_reply(struct binder_state *bs,

                       struct binder_io *reply,

                       struct binder_io *reply,

                       binder_uintptr_t buffer_to_free,

                       int status)

                       int status)

{

{

    struct {

    struct {

        uint32_t cmd_free;

        binder_uintptr_t buffer;

        uint32_t cmd_reply;

        uint32_t cmd_reply;

        struct binder_transaction_data txn;

        struct binder_transaction_data txn;

    } __attribute__((packed)) data;

    } __attribute__((packed)) data;





    data.cmd_free = BC_FREE_BUFFER;

    data.buffer = buffer_to_free;

    data.cmd_reply = BC_REPLY;

    data.cmd_reply = BC_REPLY;

    data.txn.target.ptr = 0;

    data.txn.target.ptr = 0;

    data.txn.cookie = 0;

    data.txn.cookie = 0;
@@ -250,9 +255,11 @@ int binder_parse(struct binder_state *bs, struct binder_io *bio, 
                bio_init(&reply, rdata, sizeof(rdata), 4);

                bio_init(&reply, rdata, sizeof(rdata), 4);

                bio_init_from_txn(&msg, txn);

                bio_init_from_txn(&msg, txn);

                res = func(bs, txn, &msg, &reply);

                res = func(bs, txn, &msg, &reply);

                if (txn->flags & TF_ONE_WAY) {

                    binder_free_buffer(bs, txn->data.ptr.buffer);

                    binder_free_buffer(bs, txn->data.ptr.buffer);

                if ((txn->flags & TF_ONE_WAY) == 0)

                } else {

                    binder_send_reply(bs, &reply, res);

                    binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);

                }

            }

            }

            ptr += sizeof(*txn);

            ptr += sizeof(*txn);

            break;

            break;