Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fac5232 authored by Huihong Luo's avatar Huihong Luo
Browse files

Migrate IDisplayEventConnection interface to AIDL 

This addresses security vulnerabilities due to hard coded binder
interface.

Bug: 195660647
Test: atest services/surfaceflinger/tests/unittests/SchedulerTest.cpp
Change-Id: I948e97e37056286d54623ca6232580187b138e62
parent ecc1f90e

libs/binder/include/binder/IInterface.h

+0 −1
Original line number Diff line number Diff line
@@ -228,7 +228,6 @@ constexpr const char* const kManualInterfaces[] = { 
  "android.gfx.tests.IIPCTest",

  "android.gfx.tests.ISafeInterfaceTest",

  "android.graphicsenv.IGpuService",

  "android.gui.DisplayEventConnection",

  "android.gui.IConsumerListener",

  "android.gui.IGraphicBufferConsumer",

  "android.gui.ITransactionComposerListener",

libs/gui/Android.bp

+0 −1
Original line number Diff line number Diff line
@@ -180,7 +180,6 @@ cc_library_shared { 
        "FrameTimelineInfo.cpp",

        "GLConsumer.cpp",

        "IConsumerListener.cpp",

        "IDisplayEventConnection.cpp",

        "IGraphicBufferConsumer.cpp",

        "IGraphicBufferProducer.cpp",

        "IProducerListener.cpp",

libs/gui/DisplayEventReceiver.cpp

+0 −1
Original line number Diff line number Diff line
@@ -19,7 +19,6 @@ 
#include <utils/Errors.h>



#include <gui/DisplayEventReceiver.h>

#include <gui/IDisplayEventConnection.h>

#include <gui/ISurfaceComposer.h>



#include <private/gui/ComposerService.h>

libs/gui/IDisplayEventConnection.cpp

deleted100644 → 0
+0 −80
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2011 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <gui/IDisplayEventConnection.h>



#include <private/gui/BitTube.h>



namespace android {



namespace { // Anonymous



enum class Tag : uint32_t {

    STEAL_RECEIVE_CHANNEL = IBinder::FIRST_CALL_TRANSACTION,

    SET_VSYNC_RATE,

    REQUEST_NEXT_VSYNC,

    LAST = REQUEST_NEXT_VSYNC,

};



} // Anonymous namespace



class BpDisplayEventConnection : public SafeBpInterface<IDisplayEventConnection> {

public:

    explicit BpDisplayEventConnection(const sp<IBinder>& impl)

          : SafeBpInterface<IDisplayEventConnection>(impl, "BpDisplayEventConnection") {}



    ~BpDisplayEventConnection() override;



    status_t stealReceiveChannel(gui::BitTube* outChannel) override {

        return callRemote<decltype(

                &IDisplayEventConnection::stealReceiveChannel)>(Tag::STEAL_RECEIVE_CHANNEL,

                                                                outChannel);

    }



    status_t setVsyncRate(uint32_t count) override {

        return callRemote<decltype(&IDisplayEventConnection::setVsyncRate)>(Tag::SET_VSYNC_RATE,

                                                                            count);

    }



    void requestNextVsync() override {

        callRemoteAsync<decltype(&IDisplayEventConnection::requestNextVsync)>(

                Tag::REQUEST_NEXT_VSYNC);

    }

};



// Out-of-line virtual method definition to trigger vtable emission in this translation unit (see

// clang warning -Wweak-vtables)

BpDisplayEventConnection::~BpDisplayEventConnection() = default;



IMPLEMENT_META_INTERFACE(DisplayEventConnection, "android.gui.DisplayEventConnection");



status_t BnDisplayEventConnection::onTransact(uint32_t code, const Parcel& data, Parcel* reply,

                                              uint32_t flags) {

    if (code < IBinder::FIRST_CALL_TRANSACTION || code > static_cast<uint32_t>(Tag::LAST)) {

        return BBinder::onTransact(code, data, reply, flags);

    }

    auto tag = static_cast<Tag>(code);

    switch (tag) {

        case Tag::STEAL_RECEIVE_CHANNEL:

            return callLocal(data, reply, &IDisplayEventConnection::stealReceiveChannel);

        case Tag::SET_VSYNC_RATE:

            return callLocal(data, reply, &IDisplayEventConnection::setVsyncRate);

        case Tag::REQUEST_NEXT_VSYNC:

            return callLocalAsync(data, reply, &IDisplayEventConnection::requestNextVsync);

    }

}



} // namespace android

libs/gui/ISurfaceComposer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -17,12 +17,12 @@ 
// tag as surfaceflinger

#define LOG_TAG "SurfaceFlinger"



#include <android/gui/IDisplayEventConnection.h>

#include <android/gui/IRegionSamplingListener.h>

#include <android/gui/ITransactionTraceListener.h>

#include <binder/IPCThreadState.h>

#include <binder/IServiceManager.h>

#include <binder/Parcel.h>

#include <gui/IDisplayEventConnection.h>

#include <gui/IGraphicBufferProducer.h>

#include <gui/ISurfaceComposer.h>

#include <gui/ISurfaceComposerClient.h>
@@ -44,6 +44,7 @@ 


namespace android {



using gui::IDisplayEventConnection;

using gui::IRegionSamplingListener;

using gui::IWindowInfosListener;

using ui::ColorMode;