From 2541306ad56112fad1453566561038c35ae2448a Mon Sep 17 00:00:00 2001
From: riddle_hsu <riddle_hsu@htc.com>
Date: Tue, 17 Mar 2015 18:22:51 +0800
Subject: [PATCH] [ActivityManager] Avoid killing unrelated processes.

Kernel will reuse process id, when wrap-around happens,
there may be just after a pid is freed, a new thread/process
uses the pid immediately.

For examples, there may be a process with pid 1234 killed
by lowmemorykiller or itself (app.killed=false).
Before the death recipient enters AMS, a new thread/process
is started with pid 1234, then when appDiedLocked executes,
this new pid 1234 will be killed again.

It is especially easy happens to zygote:
During zygote starting process, it will stop 5 daemons threads.
And restart the 5 threads after fork is called, so it has
larger pid range to hit the resue case.
https://code.google.com/p/android/issues/detail?id=160661

Solution:
If the dead event is from binder, it is not necessary
to call killProcessQuiet again, because it should really
be dead.
Keep no checking for killProcessGroup because zygote does
not have record under /acct/, and also the parameter uid
has restriction that will not kill another application
which reuses the pid.

Change-Id: Iec4a4884ae641c4d036f4d024ce463f7a351a17b
---
 .../com/android/server/am/ActivityManagerService.java | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 34a5249b9225c..dbf962b78f080 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -1215,7 +1215,7 @@ public final class ActivityManagerService extends ActivityManagerNative
                 TAG, "Death received in " + this
                 + " for thread " + mAppThread.asBinder());
             synchronized(ActivityManagerService.this) {
-                appDiedLocked(mApp, mPid, mAppThread);
+                appDiedLocked(mApp, mPid, mAppThread, true);
             }
         }
     }
@@ -4678,10 +4678,11 @@ public final class ActivityManagerService extends ActivityManagerNative
     }
 
     final void appDiedLocked(ProcessRecord app) {
-       appDiedLocked(app, app.pid, app.thread);
+       appDiedLocked(app, app.pid, app.thread, false);
     }
 
-    final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread) {
+    final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread,
+            boolean fromBinderDied) {
         // First check if this ProcessRecord is actually active for the pid.
         synchronized (mPidsSelfLocked) {
             ProcessRecord curProc = mPidsSelfLocked.get(pid);
@@ -4697,7 +4698,9 @@ public final class ActivityManagerService extends ActivityManagerNative
         }
 
         if (!app.killed) {
-            Process.killProcessQuiet(pid);
+            if (!fromBinderDied) {
+                Process.killProcessQuiet(pid);
+            }
             Process.killProcessGroup(app.info.uid, pid);
             app.killed = true;
         }