Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 798fe66e authored by Steven Moreland's avatar Steven Moreland
Browse files

RPC Binder: flush refcounts more reliably 

This:
- always flushes refcounts even if there is an error.
  This helps avoid a leak in some cases.
- if there is a protocol error while flushing refcounts,
  this does not try to write it back, but just returns.
  This is to limit fallout.

Bug: 419074122
Bug: 419364025
Test: binderRpcTest
Change-Id: I669cb264645fa4b2f36e47aa5af89fc69bc1cad6
parent 427e27ad

libs/binder/RpcState.cpp

+7 −3
Original line number Diff line number Diff line
@@ -1172,7 +1172,7 @@ processTransactInternalTailCall: 


        // done processing all the async commands on this binder that we can, so

        // write decstrongs on the binder

        if (addr != 0 && replyStatus == OK) {

        if (addr != 0) {

            return flushExcessBinderRefs(session, addr, target);

        }
@@ -1181,8 +1181,12 @@ processTransactInternalTailCall: 


    // Binder refs are flushed for oneway calls only after all calls which are

    // built up are executed. Otherwise, they fill up the binder buffer.

    if (addr != 0 && replyStatus == OK) {

        replyStatus = flushExcessBinderRefs(session, addr, target);

    if (addr != 0) {

        // if this fails, we are broken out of the protocol, so just shutdown. There

        // is no chance we could write the status to the other side.

        if (status_t status = flushExcessBinderRefs(session, addr, target); status != OK) {

            return status;

        }

    }



    std::string errorMsg;