From 0f3b9572b7f78adb33d2bd68cbc45ae8b06d1034 Mon Sep 17 00:00:00 2001
From: chaviw <chaviw@google.com>
Date: Wed, 20 May 2020 11:34:52 -0700
Subject: [PATCH] Clear calling identity when requesting syncInputTransaction

The syncInputTransaction can trigger a performSurfacePlacement which
could result in a callback to the client. In that case, the calling PID
will be incorrect since we didn't clear the calling identity before
requesting the performSurfacePlacement.

Bug: 154665556
Test: Hard to reproduce. Existing tests pass
Change-Id: Id7c35d356cfc435e2de225e4e0d3979751c5c7d4
---
 .../server/wm/WindowManagerService.java       | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index 5c21b2b514ce2..159c59b86b436 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -7922,18 +7922,23 @@ public class WindowManagerService extends IWindowManager.Stub
 
     @Override
     public void syncInputTransactions() {
-        waitForAnimationsToComplete();
+        long token = Binder.clearCallingIdentity();
+        try {
+            waitForAnimationsToComplete();
 
-        // Collect all input transactions from all displays to make sure we could sync all input
-        // windows at same time.
-        final SurfaceControl.Transaction t = mTransactionFactory.get();
-        synchronized (mGlobalLock) {
-            mWindowPlacerLocked.performSurfacePlacementIfScheduled();
-            mRoot.forAllDisplays(displayContent ->
-                    displayContent.getInputMonitor().updateInputWindowsImmediately(t));
+            // Collect all input transactions from all displays to make sure we could sync all input
+            // windows at same time.
+            final SurfaceControl.Transaction t = mTransactionFactory.get();
+            synchronized (mGlobalLock) {
+                mWindowPlacerLocked.performSurfacePlacementIfScheduled();
+                mRoot.forAllDisplays(displayContent ->
+                        displayContent.getInputMonitor().updateInputWindowsImmediately(t));
+            }
+
+            t.syncInputWindows().apply();
+        } finally {
+            Binder.restoreCallingIdentity(token);
         }
-
-        t.syncInputWindows().apply();
     }
 
     /**