Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ensure embedded window's channel is not disposed before being duped

Browse Source 
If the InputChannel is created inside a critical section, but then
duped to another channel after the lock is released, it's possible
the channel could be disposed (e.g. because window is removed) before
the duplication happens. To prevent this, dup the InputChannel in the
same critical section as where it was created.

Bug: 283314325
Test: Presubmit
Change-Id: I00dd3e54240512a6d2ddfe7ec40a6c4f14d837fc
This commit is contained in:
Prabir Pradhan
2023-05-31 20:38:50 +00:00
parent 6bcaace5d2
commit 2eb99915cf
2 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
services/core/java/com/android/server/wm/EmbeddedWindowController.java
View File

@@ -23,6 +23,7 @@ import static com.android.server.wm.WindowManagerDebugConfig.TAG_WITH_CLASS_NAME
import static com.android.server.wm.WindowManagerDebugConfig.TAG_WM;
import static com.android.server.wm.WindowStateProto.IDENTIFIER;
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.os.IBinder;
import android.os.RemoteException;
@@ -217,10 +218,10 @@ class EmbeddedWindowController {
mHostWindowState.mInputWindowHandle.getInputApplicationHandle());
}
InputChannel openInputChannel() {
void openInputChannel(@NonNull InputChannel outInputChannel) {
final String name = toString();
mInputChannel = mWmService.mInputManager.createInputChannel(name);
return mInputChannel;
mInputChannel.copyTo(outInputChannel);
}
void onRemoved() {

10
services/core/java/com/android/server/wm/WindowManagerService.java
View File

@@ -8738,24 +8738,22 @@ public class WindowManagerService extends IWindowManager.Stub
final int sanitizedType = sanitizeWindowType(session, displayId, windowToken, type);
final InputApplicationHandle applicationHandle;
final String name;
final InputChannel clientChannel;
Objects.requireNonNull(outInputChannel);
synchronized (mGlobalLock) {
EmbeddedWindowController.EmbeddedWindow win =
new EmbeddedWindowController.EmbeddedWindow(session, this, window,
mInputToWindowMap.get(hostInputToken), callingUid, callingPid,
sanitizedType, displayId, focusGrantToken, inputHandleName,
(flags & FLAG_NOT_FOCUSABLE) == 0);
clientChannel = win.openInputChannel();
mEmbeddedWindowController.add(clientChannel.getToken(), win);
win.openInputChannel(outInputChannel);
mEmbeddedWindowController.add(outInputChannel.getToken(), win);
applicationHandle = win.getApplicationHandle();
name = win.toString();
}
updateInputChannel(clientChannel.getToken(), callingUid, callingPid, displayId, surface,
updateInputChannel(outInputChannel.getToken(), callingUid, callingPid, displayId, surface,
name, applicationHandle, flags, privateFlags, inputFeatures, sanitizedType,
null /* region */, window);
clientChannel.copyTo(outInputChannel);
}
boolean transferEmbeddedTouchFocusToHost(IWindow embeddedWindow) {