Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52be2c9f authored by Connor O'Brien's avatar Connor O'Brien Committed by Martijn Coenen
Browse files

Add binder test for bug 30445380 



Test: Ran on fixed and unfixed kernel.

Change-Id: I259c6ff7e952c49d3a1f80a4310d2f6ebc193682
Merged-In: Ic5c49fde75af7a4606871b07a3f39c0c34824c8b
Signed-off-by: default avatarConnor O'Brien <connoro@google.com>
parent 7060431a

libs/binder/tests/binderLibTest.cpp

+52 −0
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ enum BinderLibTestTranscationCode { 
    BINDER_LIB_TEST_EXIT_TRANSACTION,

    BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION,

    BINDER_LIB_TEST_GET_PTR_SIZE_TRANSACTION,

    BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION,

};



pid_t start_server_process(int arg2)
@@ -686,6 +687,47 @@ TEST_F(BinderLibTest, CheckHandleZeroBinderHighBitsZeroCookie) { 
    EXPECT_EQ(fb->binder >> 32, (binder_uintptr_t)0);

}



TEST_F(BinderLibTest, FreedBinder) {

    status_t ret;



    sp<IBinder> server = addServer();

    ASSERT_TRUE(server != NULL);



    __u32 freedHandle;

    wp<IBinder> keepFreedBinder;

    {

        Parcel data, reply;

        data.writeBool(false); /* request weak reference */

        ret = server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION, data, &reply);

        ASSERT_EQ(NO_ERROR, ret);

        struct flat_binder_object *freed = (struct flat_binder_object *)(reply.data());

        freedHandle = freed->handle;

        /* Add a weak ref to the freed binder so the driver does not

         * delete its reference to it - otherwise the transaction

         * fails regardless of whether the driver is fixed.

         */

        keepFreedBinder = reply.readWeakBinder();

    }

    {

        Parcel data, reply;

        data.writeStrongBinder(server);

        /* Replace original handle with handle to the freed binder */

        struct flat_binder_object *strong = (struct flat_binder_object *)(data.data());

        __u32 oldHandle = strong->handle;

        strong->handle = freedHandle;

        ret = server->transact(BINDER_LIB_TEST_ADD_STRONG_REF_TRANSACTION, data, &reply);

        /* Returns DEAD_OBJECT (-32) if target crashes and

         * FAILED_TRANSACTION if the driver rejects the invalid

         * object.

         */

        EXPECT_EQ((status_t)FAILED_TRANSACTION, ret);

        /* Restore original handle so parcel destructor does not use

         * the wrong handle.

         */

        strong->handle = oldHandle;

    }

}



class BinderLibTestService : public BBinder

{

    public:
@@ -903,6 +945,16 @@ class BinderLibTestService : public BBinder 
                while (wait(NULL) != -1 || errno != ECHILD)

                    ;

                exit(EXIT_SUCCESS);

            case BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION: {

                bool strongRef = data.readBool();

                sp<IBinder> binder = new BBinder();

                if (strongRef) {

                    reply->writeStrongBinder(binder);

                } else {

                    reply->writeWeakBinder(binder);

                }

                return NO_ERROR;

            }

            default:

                return UNKNOWN_TRANSACTION;

            };