From 643bc5ce5eb48d448b9d4bfd109b9222e19b8cf2 Mon Sep 17 00:00:00 2001 From: Evgenii Stepanov Date: Wed, 8 Dec 2021 16:40:32 -0800 Subject: [PATCH 1/2] Revert "Pass MTE RuntimeFlags to AppZygote." The change affects non-MTE devices, contrary to the claims in the description. This reverts commit 8895ef1256411a4eda96aa4aa6dd4c9147118737. Bug: 207557677 Test: CtsTaggingHostTestCases Change-Id: I033ee79ce05db87586358ba954ecfcaf8aaa6249 --- core/java/android/os/AppZygote.java | 8 ++------ services/core/java/com/android/server/am/ProcessList.java | 3 +-- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/core/java/android/os/AppZygote.java b/core/java/android/os/AppZygote.java index c8b4226ecae0f..74b814ea4159d 100644 --- a/core/java/android/os/AppZygote.java +++ b/core/java/android/os/AppZygote.java @@ -45,8 +45,6 @@ public class AppZygote { // Last UID/GID of the range the AppZygote can setuid()/setgid() to private final int mZygoteUidGidMax; - private final int mZygoteRuntimeFlags; - private final Object mLock = new Object(); /** @@ -58,13 +56,11 @@ public class AppZygote { private final ApplicationInfo mAppInfo; - public AppZygote(ApplicationInfo appInfo, int zygoteUid, int uidGidMin, int uidGidMax, - int runtimeFlags) { + public AppZygote(ApplicationInfo appInfo, int zygoteUid, int uidGidMin, int uidGidMax) { mAppInfo = appInfo; mZygoteUid = zygoteUid; mZygoteUidGidMin = uidGidMin; mZygoteUidGidMax = uidGidMax; - mZygoteRuntimeFlags = runtimeFlags; } /** @@ -114,7 +110,7 @@ public class AppZygote { mZygoteUid, mZygoteUid, null, // gids - mZygoteRuntimeFlags, // runtimeFlags + 0, // runtimeFlags "app_zygote", // seInfo abi, // abi abi, // acceptedAbiList diff --git a/services/core/java/com/android/server/am/ProcessList.java b/services/core/java/com/android/server/am/ProcessList.java index f35afa5b7ca0f..b77270f5963bb 100644 --- a/services/core/java/com/android/server/am/ProcessList.java +++ b/services/core/java/com/android/server/am/ProcessList.java @@ -2238,8 +2238,7 @@ public final class ProcessList { // not the calling one. appInfo.packageName = app.getHostingRecord().getDefiningPackageName(); appInfo.uid = uid; - int runtimeFlags = decideTaggingLevel(app); - appZygote = new AppZygote(appInfo, uid, firstUid, lastUid, runtimeFlags); + appZygote = new AppZygote(appInfo, uid, firstUid, lastUid); mAppZygotes.put(app.info.processName, uid, appZygote); zygoteProcessList = new ArrayList(); mAppZygoteProcesses.put(appZygote, zygoteProcessList); From 2e50afbd53c686a7cb82c73e926ab34d7dd9257d Mon Sep 17 00:00:00 2001 From: Evgenii Stepanov Date: Fri, 3 Dec 2021 17:06:46 -0800 Subject: [PATCH 2/2] Pass MTE RuntimeFlags to AppZygote. Fix AppZygote process and its children (the actual service processes) ignoring android:memtagMode attribute in the app manifest. When starting a new AppZygote process, apply memtag-related flags as determined by the app manifest (and modified by compat features and actual h/w capabilities). If this is not done, MTE is always disabled in an AppZygote process, which makes it impossible to enable it in the AppZygote's children. This change has no effect unless MTE is supported in the hardware (ARMv9) and enabled in the system. Bug: 207557677 Test: CtsTaggingHostTestCases Change-Id: Ibf64db8882a1fbffe6c0cc3cd3bc2299b088876a --- core/java/android/os/AppZygote.java | 8 +++++-- .../com/android/server/am/ProcessList.java | 23 ++++++++++++++++++- 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/core/java/android/os/AppZygote.java b/core/java/android/os/AppZygote.java index 74b814ea4159d..c8b4226ecae0f 100644 --- a/core/java/android/os/AppZygote.java +++ b/core/java/android/os/AppZygote.java @@ -45,6 +45,8 @@ public class AppZygote { // Last UID/GID of the range the AppZygote can setuid()/setgid() to private final int mZygoteUidGidMax; + private final int mZygoteRuntimeFlags; + private final Object mLock = new Object(); /** @@ -56,11 +58,13 @@ public class AppZygote { private final ApplicationInfo mAppInfo; - public AppZygote(ApplicationInfo appInfo, int zygoteUid, int uidGidMin, int uidGidMax) { + public AppZygote(ApplicationInfo appInfo, int zygoteUid, int uidGidMin, int uidGidMax, + int runtimeFlags) { mAppInfo = appInfo; mZygoteUid = zygoteUid; mZygoteUidGidMin = uidGidMin; mZygoteUidGidMax = uidGidMax; + mZygoteRuntimeFlags = runtimeFlags; } /** @@ -110,7 +114,7 @@ public class AppZygote { mZygoteUid, mZygoteUid, null, // gids - 0, // runtimeFlags + mZygoteRuntimeFlags, // runtimeFlags "app_zygote", // seInfo abi, // abi abi, // acceptedAbiList diff --git a/services/core/java/com/android/server/am/ProcessList.java b/services/core/java/com/android/server/am/ProcessList.java index b77270f5963bb..6c84ca4d9251e 100644 --- a/services/core/java/com/android/server/am/ProcessList.java +++ b/services/core/java/com/android/server/am/ProcessList.java @@ -373,6 +373,16 @@ public final class ProcessList { @EnabledAfter(targetSdkVersion = Build.VERSION_CODES.Q) private static final long NATIVE_HEAP_POINTER_TAGGING = 135754954; // This is a bug id. + /** + * Native heap allocations in AppZygote process and its descendants will now have a + * non-zero tag in the most significant byte. + * @see Tagged + * Pointers + */ + @ChangeId + @EnabledAfter(targetSdkVersion = Build.VERSION_CODES.S) + private static final long NATIVE_HEAP_POINTER_TAGGING_APP_ZYGOTE = 207557677; + /** * Enable asynchronous (ASYNC) memory tag checking in this process. This * flag will only have an effect on hardware supporting the ARM Memory @@ -1738,6 +1748,16 @@ public final class ProcessList { return level; } + private int decideTaggingLevelForAppZygote(ProcessRecord app) { + int level = decideTaggingLevel(app); + // TBI ("fake" pointer tagging) in AppZygote is controlled by a separate compat feature. + if (!mPlatformCompat.isChangeEnabled(NATIVE_HEAP_POINTER_TAGGING_APP_ZYGOTE, app.info) + && level == Zygote.MEMORY_TAG_LEVEL_TBI) { + level = Zygote.MEMORY_TAG_LEVEL_NONE; + } + return level; + } + private int decideGwpAsanLevel(ProcessRecord app) { // Look at the process attribute first. if (app.processInfo != null @@ -2238,7 +2258,8 @@ public final class ProcessList { // not the calling one. appInfo.packageName = app.getHostingRecord().getDefiningPackageName(); appInfo.uid = uid; - appZygote = new AppZygote(appInfo, uid, firstUid, lastUid); + int runtimeFlags = decideTaggingLevelForAppZygote(app); + appZygote = new AppZygote(appInfo, uid, firstUid, lastUid, runtimeFlags); mAppZygotes.put(app.info.processName, uid, appZygote); zygoteProcessList = new ArrayList(); mAppZygoteProcesses.put(appZygote, zygoteProcessList);