From 15358d50ea3cd38605e4bb2a6236df3155ac552d Mon Sep 17 00:00:00 2001
From: Fiona Campbell <flc@google.com>
Date: Thu, 30 Sep 2021 11:26:42 +0000
Subject: [PATCH] Make setBrightnessConfigurationForUser locked

Ensure that locked methods aren't being called outside the correct lock.

Test: manual
Bug: 200656677

Change-Id: Idca0a3b3e3480b51d8e421ab4972547f9b16c5d5
---
 .../server/display/DisplayManagerService.java | 31 ++++++++++++++-----
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/services/core/java/com/android/server/display/DisplayManagerService.java b/services/core/java/com/android/server/display/DisplayManagerService.java
index f16ed41af5caa..7045ba0e2ce7f 100644
--- a/services/core/java/com/android/server/display/DisplayManagerService.java
+++ b/services/core/java/com/android/server/display/DisplayManagerService.java
@@ -2863,14 +2863,31 @@ public final class DisplayManagerService extends SystemService {
         @Override // Binder call
         public void setBrightnessConfigurationForUser(
                 BrightnessConfiguration c, @UserIdInt int userId, String packageName) {
-            mLogicalDisplayMapper.forEachLocked(logicalDisplay -> {
-                if (logicalDisplay.getDisplayInfoLocked().type != Display.TYPE_INTERNAL) {
-                    return;
+            mContext.enforceCallingOrSelfPermission(
+                    Manifest.permission.CONFIGURE_DISPLAY_BRIGHTNESS,
+                    "Permission required to change the display's brightness configuration");
+            if (userId != UserHandle.getCallingUserId()) {
+                mContext.enforceCallingOrSelfPermission(
+                        Manifest.permission.INTERACT_ACROSS_USERS,
+                        "Permission required to change the display brightness"
+                                + " configuration of another user");
+            }
+            final long token = Binder.clearCallingIdentity();
+            try {
+                synchronized (mSyncRoot) {
+                    mLogicalDisplayMapper.forEachLocked(logicalDisplay -> {
+                        if (logicalDisplay.getDisplayInfoLocked().type != Display.TYPE_INTERNAL) {
+                            return;
+                        }
+                        final DisplayDevice displayDevice =
+                                logicalDisplay.getPrimaryDisplayDeviceLocked();
+                        setBrightnessConfigurationForDisplayInternal(c, displayDevice.getUniqueId(),
+                                userId, packageName);
+                    });
                 }
-                final DisplayDevice displayDevice = logicalDisplay.getPrimaryDisplayDeviceLocked();
-                setBrightnessConfigurationForDisplay(c, displayDevice.getUniqueId(), userId,
-                        packageName);
-            });
+            } finally {
+                Binder.restoreCallingIdentity(token);
+            }
         }
 
         @Override // Binder call