From 170c118b8105c9bb55d801e2eb4e6c12a89ac80c Mon Sep 17 00:00:00 2001
From: Jaewan Kim <jaewan@google.com>
Date: Thu, 20 Aug 2020 16:58:32 +0900
Subject: [PATCH] DO NOT MERGE: Fix incorrect use of
 UserHandle#getUserHandleForUid(int uid)

Two issues were mixed here.
issue 1) User ID was used when UID was necessary.
issue 2) Caller UID was used when checking target UID.

Note that this bug would affect multi-user environment.

(Cherry-picked from c8fc993b4260fbd10bfa9e3d12c4616ac0d5c6c9)

Bug: 162548695
Test: Build and run CTS
Change-Id: I83909b4a6c82af805a26848fe4a0189c579ddf0d
---
 .../server/media/MediaSessionService.java     | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/services/core/java/com/android/server/media/MediaSessionService.java b/services/core/java/com/android/server/media/MediaSessionService.java
index 9b356f0e8eef8..803eb862e0f11 100644
--- a/services/core/java/com/android/server/media/MediaSessionService.java
+++ b/services/core/java/com/android/server/media/MediaSessionService.java
@@ -1937,7 +1937,8 @@ public class MediaSessionService extends SystemService implements Monitor {
                 // Context#getPackageName() for getting package name that matches with the PID/UID,
                 // but it doesn't tell which package has created the MediaController, so useless.
                 return hasMediaControlPermission(controllerPid, controllerUid)
-                        || hasEnabledNotificationListener(userId, controllerPackageName);
+                        || hasEnabledNotificationListener(
+                                userId, controllerPackageName, controllerUid);
             } finally {
                 Binder.restoreCallingIdentity(token);
             }
@@ -2001,29 +2002,29 @@ public class MediaSessionService extends SystemService implements Monitor {
             return resolvedUserId;
         }
 
-        private boolean hasEnabledNotificationListener(int resolvedUserId, String packageName)
-                throws RemoteException {
-            // You may not access another user's content as an enabled listener.
-            final int userId = UserHandle.getUserId(resolvedUserId);
-            if (resolvedUserId != userId) {
+        private boolean hasEnabledNotificationListener(int callingUserId,
+                String controllerPackageName, int controllerUid) throws RemoteException {
+            int controllerUserId = UserHandle.getUserHandleForUid(controllerUid).getIdentifier();
+            if (callingUserId != controllerUserId) {
+                // Enabled notification listener only works within the same user.
                 return false;
             }
 
             // TODO(jaewan): (Post-P) Propose NotificationManager#hasEnabledNotificationListener(
             //               String pkgName) to notification team for optimization
             final List<ComponentName> enabledNotificationListeners =
-                    mNotificationManager.getEnabledNotificationListeners(userId);
+                    mNotificationManager.getEnabledNotificationListeners(controllerUserId);
             if (enabledNotificationListeners != null) {
                 for (int i = 0; i < enabledNotificationListeners.size(); i++) {
-                    if (TextUtils.equals(packageName,
+                    if (TextUtils.equals(controllerPackageName,
                             enabledNotificationListeners.get(i).getPackageName())) {
                         return true;
                     }
                 }
             }
             if (DEBUG) {
-                Log.d(TAG, packageName + " (uid=" + resolvedUserId + ") doesn't have an enabled "
-                        + "notification listener");
+                Log.d(TAG, controllerPackageName + " (uid=" + controllerUid
+                        + ") doesn't have an enabled notification listener");
             }
             return false;
         }