Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9167e7c authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix GATT client leakage when scan is throttled (1/2) 

Currently, scan throttling happens after client is registered, but
before the scan is started. This might lead to scan client being leaked.
This patch fixed that by moving check before client registration.

Bug: 64887233
Test: manual
Change-Id: I96e7698a126b41c4fd5e2ce11d1c9084fd560dfc
parent a134983d

android/app/src/com/android/bluetooth/gatt/GattService.java

+14 −20
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ import android.bluetooth.le.IPeriodicAdvertisingCallback; 
import android.bluetooth.le.IScannerCallback;

import android.bluetooth.le.PeriodicAdvertisingParameters;

import android.bluetooth.le.ResultStorageDescriptor;

import android.bluetooth.le.ScanCallback;

import android.bluetooth.le.ScanFilter;

import android.bluetooth.le.ScanRecord;

import android.bluetooth.le.ScanResult;
@@ -367,7 +368,8 @@ public class GattService extends ProfileService { 
            service.unregisterClient(clientIf);

        }



        public void registerScanner(IScannerCallback callback, WorkSource workSource) {

        public void registerScanner(IScannerCallback callback, WorkSource workSource)

                throws RemoteException {

            GattService service = getService();

            if (service == null) return;

            service.registerScanner(callback, workSource);
@@ -1558,7 +1560,7 @@ public class GattService extends ProfileService { 
        return deviceList;

    }



    void registerScanner(IScannerCallback callback, WorkSource workSource) {

    void registerScanner(IScannerCallback callback, WorkSource workSource) throws RemoteException {

        enforceCallingOrSelfPermission(BLUETOOTH_PERM, "Need BLUETOOTH permission");



        UUID uuid = UUID.randomUUID();
@@ -1569,6 +1571,14 @@ public class GattService extends ProfileService { 
        }



        mScannerMap.add(uuid, workSource, callback, null, this);

        AppScanStats app = mScannerMap.getAppScanStatsByUid(Binder.getCallingUid());

        if (app != null && app.isScanningTooFrequently()

                && checkCallingOrSelfPermission(BLUETOOTH_PRIVILEGED) != PERMISSION_GRANTED) {

            Log.e(TAG, "App '" + app.appName + "' is scanning too frequently");

            callback.onScannerRegistered(ScanCallback.SCAN_FAILED_SCANNING_TOO_FREQUENTLY, -1);

            return;

        }



        mScanManager.registerScanner(uuid);

    }
@@ -1594,17 +1604,9 @@ public class GattService extends ProfileService { 
                this);

        scanClient.legacyForegroundApp = Utils.isLegacyForegroundApp(this, callingPackage);



        AppScanStats app = null;

        app = mScannerMap.getAppScanStatsById(scannerId);



        AppScanStats app = mScannerMap.getAppScanStatsById(scannerId);

        if (app != null) {

            if (app.isScanningTooFrequently() &&

                checkCallingOrSelfPermission(BLUETOOTH_PRIVILEGED) != PERMISSION_GRANTED) {

                Log.e(TAG, "App '" + app.appName + "' is scanning too frequently");

                return;

            }

            scanClient.stats = app;



            boolean isFilteredScan = (filters != null) && !filters.isEmpty();

            app.recordScanStart(settings, isFilteredScan, scannerId);

        }
@@ -1642,17 +1644,9 @@ public class GattService extends ProfileService { 
        // this);

        scanClient.legacyForegroundApp = Utils.isLegacyForegroundApp(this, piInfo.callingPackage);



        AppScanStats app = null;

        app = mScannerMap.getAppScanStatsById(scannerId);



        AppScanStats app = mScannerMap.getAppScanStatsById(scannerId);

        if (app != null) {

            if (app.isScanningTooFrequently()

                    && checkCallingOrSelfPermission(BLUETOOTH_PRIVILEGED) != PERMISSION_GRANTED) {

                Log.e(TAG, "App '" + app.appName + "' is scanning too frequently");

                return;

            }

            scanClient.stats = app;



            boolean isFilteredScan = (piInfo.filters != null) && !piInfo.filters.isEmpty();

            app.recordScanStart(piInfo.settings, isFilteredScan, scannerId);

        }