Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f183fdd0 authored by Steven Moreland's avatar Steven Moreland
Browse files

libbinder: support TF_CLEAR_BUF 

This flag instructs the kernel to clear transactions from send/reply
buffers for certain transactions which may contain sensitive data, as a
security precaution.

Bug: 171501998
Test: binderLibTest (only checks there is no error)
Change-Id: I69d732e5cc2b15472dc52d47c66716bc1b3be6ae
parent b40b64d0

libs/binder/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ cc_library { 
        "Stability.cpp",

        "Status.cpp",

        "TextOutput.cpp",

        "Utils.cpp",

        ":libbinder_aidl",

    ],

libs/binder/Binder.cpp

+4 −0
Original line number Diff line number Diff line
@@ -173,6 +173,10 @@ status_t BBinder::transact( 
{

    data.setDataPosition(0);



    if (reply != nullptr && (flags & FLAG_CLEAR_BUF)) {

        reply->markSensitive();

    }



    status_t err = NO_ERROR;

    switch (code) {

        case PING_TRANSACTION:

libs/binder/IPCThreadState.cpp

+3 −1
Original line number Diff line number Diff line
@@ -1244,7 +1244,9 @@ status_t IPCThreadState::executeCommand(int32_t cmd) 
            if ((tr.flags & TF_ONE_WAY) == 0) {

                LOG_ONEWAY("Sending reply to %d!", mCallingPid);

                if (error < NO_ERROR) reply.setError(error);

                sendReply(reply, 0);



                constexpr uint32_t kForwardReplyFlags = TF_CLEAR_BUF;

                sendReply(reply, (tr.flags & kForwardReplyFlags));

            } else {

                if (error != OK || reply.dataSize() != 0) {

                    alog << "oneway function results will be dropped but finished with status "

libs/binder/Parcel.cpp

+27 −2
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ 


#include <private/binder/binder_module.h>

#include "Static.h"

#include "Utils.h"



#define LOG_REFS(...)

//#define LOG_REFS(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
@@ -502,6 +503,11 @@ bool Parcel::hasFileDescriptors() const 
    return mHasFds;

}



void Parcel::markSensitive() const

{

    mDeallocZero = true;

}



void Parcel::updateWorkSourceRequestHeaderPosition() const {

    // Only update the request headers once. We only want to point

    // to the first headers read/written.
@@ -2627,6 +2633,9 @@ void Parcel::freeDataNoInit() 
            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);

            gParcelGlobalAllocSize -= mDataCapacity;

            gParcelGlobalAllocCount--;

            if (mDeallocZero) {

                zeroMemory(mData, mDataSize);

            }

            free(mData);

        }

        if (mObjects) free(mObjects);
@@ -2649,6 +2658,21 @@ status_t Parcel::growData(size_t len) 
            : continueWrite(std::max(newSize, (size_t) 128));

}



static uint8_t* reallocZeroFree(uint8_t* data, size_t oldCapacity, size_t newCapacity, bool zero) {

    if (!zero) {

        return (uint8_t*)realloc(data, newCapacity);

    }

    uint8_t* newData = (uint8_t*)malloc(newCapacity);

    if (!newData) {

        return nullptr;

    }



    memcpy(newData, data, std::min(oldCapacity, newCapacity));

    zeroMemory(data, oldCapacity);

    free(data);

    return newData;

}



status_t Parcel::restartWrite(size_t desired)

{

    if (desired > INT32_MAX) {
@@ -2662,7 +2686,7 @@ status_t Parcel::restartWrite(size_t desired) 
        return continueWrite(desired);

    }



    uint8_t* data = (uint8_t*)realloc(mData, desired);

    uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);

    if (!data && desired > mDataCapacity) {

        mError = NO_MEMORY;

        return NO_MEMORY;
@@ -2813,7 +2837,7 @@ status_t Parcel::continueWrite(size_t desired) 


        // We own the data, so we can just do a realloc().

        if (desired > mDataCapacity) {

            uint8_t* data = (uint8_t*)realloc(mData, desired);

            uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);

            if (data) {

                LOG_ALLOC("Parcel %p: continue from %zu to %zu capacity", this, mDataCapacity,

                        desired);
@@ -2881,6 +2905,7 @@ void Parcel::initState() 
    mHasFds = false;

    mFdsKnown = true;

    mAllowFds = true;

    mDeallocZero = false;

    mOwner = nullptr;

    mOpenAshmemSize = 0;

    mWorkSourceRequestHeaderPosition = 0;

libs/binder/Utils.cpp

0 → 100644
+27 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include "Utils.h"



#include <string.h>



namespace android {



void zeroMemory(uint8_t* data, size_t size) {

    memset(data, 0, size);

}



}   // namespace android