Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbbc33e9 authored by Matthew Maurer's avatar Matthew Maurer
Browse files

binder: rust: Fix dropped service memleak 

When `Binder<T>` objects die, they call the on_destroy for their class.
On creation, the value was put into a Box. On destruction,
`ptr::drop_in_place` was used to drop them. This means that while `Drop`
was called on T, the box was not freed.

Bug: 190517824
Test: Ran with showmap to confirm operations not leaking
Merged-In: Ie9932cc67016eecff4d24ac0c8fcd1bc7df27b32
Change-Id: Ie9932cc67016eecff4d24ac0c8fcd1bc7df27b32
parent 9c187a35

libs/binder/rust/src/native.rs

+1 −2
Original line number Diff line number Diff line
@@ -24,7 +24,6 @@ use std::convert::TryFrom; 
use std::ffi::{c_void, CString};

use std::mem::ManuallyDrop;

use std::ops::Deref;

use std::ptr;



/// Rust wrapper around Binder remotable objects.

///
@@ -273,7 +272,7 @@ impl<T: Remotable> InterfaceClassMethods for Binder<T> { 
    /// Must be called with a valid pointer to a `T` object. After this call,

    /// the pointer will be invalid and should not be dereferenced.

    unsafe extern "C" fn on_destroy(object: *mut c_void) {

        ptr::drop_in_place(object as *mut T)

        Box::from_raw(object as *mut T);

    }



    /// Called whenever a new, local `AIBinder` object is needed of a specific