From 592bacb778489d075341c43ed20029562e6d75fa Mon Sep 17 00:00:00 2001 From: Curtis Belmonte Date: Thu, 15 Jul 2021 17:02:57 -0700 Subject: [PATCH] Require non-null HAT for fingerprint enrollment Fingerprint service providers expect to be given a non-null HAT and will crash otherwise. Documents that any HAT passed to these providers must be non-null to avoid crashing system server. Also adds logging to catch a potential source of a null HAT. Test: Manual Bug: 193811614 Change-Id: Ib05541653eab04390e9928ada37bde8d088cbc84 --- .../sensors/fingerprint/FingerprintService.java | 6 +++--- .../biometrics/sensors/fingerprint/ServiceProvider.java | 9 ++++++--- .../sensors/fingerprint/aidl/FingerprintProvider.java | 7 ++++--- .../android/server/locksettings/LockSettingsService.java | 2 ++ 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java index 012e47e425f64..183fabdc2a7b0 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java @@ -215,9 +215,9 @@ public class FingerprintService extends SystemService { } @Override // Binder call - public void enroll(final IBinder token, final byte[] hardwareAuthToken, final int userId, - final IFingerprintServiceReceiver receiver, final String opPackageName, - @FingerprintManager.EnrollReason int enrollReason) { + public void enroll(final IBinder token, @NonNull final byte[] hardwareAuthToken, + final int userId, final IFingerprintServiceReceiver receiver, + final String opPackageName, @FingerprintManager.EnrollReason int enrollReason) { Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final Pair provider = getSingleProvider(); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java index 3a214f44c0a8e..706ac10137467 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java @@ -85,9 +85,12 @@ public interface ServiceProvider { void scheduleRevokeChallenge(int sensorId, int userId, @NonNull IBinder token, @NonNull String opPackageName, long challenge); - void scheduleEnroll(int sensorId, @NonNull IBinder token, byte[] hardwareAuthToken, int userId, - @NonNull IFingerprintServiceReceiver receiver, @NonNull String opPackageName, - @FingerprintManager.EnrollReason int enrollReason, + /** + * Schedules fingerprint enrollment. + */ + void scheduleEnroll(int sensorId, @NonNull IBinder token, @NonNull byte[] hardwareAuthToken, + int userId, @NonNull IFingerprintServiceReceiver receiver, + @NonNull String opPackageName, @FingerprintManager.EnrollReason int enrollReason, @NonNull FingerprintStateCallback fingerprintStateCallback); void cancelEnrollment(int sensorId, @NonNull IBinder token); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java index 096c3111d35c9..6fafabe38c8e0 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java @@ -329,9 +329,10 @@ public class FingerprintProvider implements IBinder.DeathRecipient, ServiceProvi } @Override - public void scheduleEnroll(int sensorId, @NonNull IBinder token, byte[] hardwareAuthToken, - int userId, @NonNull IFingerprintServiceReceiver receiver, - @NonNull String opPackageName, @FingerprintManager.EnrollReason int enrollReason, + public void scheduleEnroll(int sensorId, @NonNull IBinder token, + @NonNull byte[] hardwareAuthToken, int userId, + @NonNull IFingerprintServiceReceiver receiver, @NonNull String opPackageName, + @FingerprintManager.EnrollReason int enrollReason, @NonNull FingerprintStateCallback fingerprintStateCallback) { mHandler.post(() -> { final int maxTemplatesPerUser = mSensors.get(sensorId).getSensorProperties() diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 0bec09cd003f9..c0b8648b53288 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -2174,6 +2174,7 @@ public class LockSettingsService extends ILockSettings.Stub { @Override public VerifyCredentialResponse verifyGatekeeperPasswordHandle(long gatekeeperPasswordHandle, long challenge, int userId) { + checkPasswordReadPermission(); final VerifyCredentialResponse response; @@ -2185,6 +2186,7 @@ public class LockSettingsService extends ILockSettings.Stub { synchronized (mSpManager) { if (gatekeeperPassword == null) { + Slog.d(TAG, "No gatekeeper password for handle"); response = VerifyCredentialResponse.ERROR; } else { response = mSpManager.verifyChallengeInternal(getGateKeeperService(),