Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DO NOT MERGE: Clean up when recycling a pid with a pending launch

Browse Source 
Fix for accidental launch of a broadcast receiver in an
incorrect app instance.

Bug: 30202481
Change-Id: I8ec8f19c633f3aec8da084dab5fd5b312443336f
This commit is contained in:
Amith Yamasani
2016-08-05 15:25:03 -07:00
committed by Sudheer Shanka
parent 62783bde30
commit b02862c2cf
2 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -3068,6 +3068,15 @@ public final class ActivityManagerService extends ActivityManagerNative
app.killedByAm = false; app.killedByAm = false;
checkTime(startTime, "startProcess: starting to update pids map"); checkTime(startTime, "startProcess: starting to update pids map");
synchronized (mPidsSelfLocked) { synchronized (mPidsSelfLocked) {
ProcessRecord oldApp;
// If there is already an app occupying that pid that hasn't been cleaned up
if ((oldApp = mPidsSelfLocked.get(startResult.pid)) != null && !app.isolated) {
// Clean up anything relating to this pid first
Slog.w(TAG, "Reusing pid " + startResult.pid
+ " while app is still mapped to it");
cleanUpApplicationRecordLocked(oldApp, false, false, -1,
true /*replacingPid*/);
}
this.mPidsSelfLocked.put(startResult.pid, app); this.mPidsSelfLocked.put(startResult.pid, app);
if (isActivityProcess) { if (isActivityProcess) {
Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG); Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
@@ -4558,7 +4567,8 @@ public final class ActivityManagerService extends ActivityManagerNative
private final void handleAppDiedLocked(ProcessRecord app, private final void handleAppDiedLocked(ProcessRecord app,
boolean restarting, boolean allowRestart) { boolean restarting, boolean allowRestart) {
int pid = app.pid; int pid = app.pid;
boolean kept = cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1); boolean kept = cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1,
false /*replacingPid*/);
if (!kept && !restarting) { if (!kept && !restarting) {
removeLruProcessLocked(app); removeLruProcessLocked(app);
if (pid > 0) { if (pid > 0) {
@@ -14875,7 +14885,8 @@ public final class ActivityManagerService extends ActivityManagerNative
* app that was passed in must remain on the process lists. * app that was passed in must remain on the process lists.
*/ */
private final boolean cleanUpApplicationRecordLocked(ProcessRecord app, private final boolean cleanUpApplicationRecordLocked(ProcessRecord app,
boolean restarting, boolean allowRestart, int index) { boolean restarting, boolean allowRestart, int index, boolean replacingPid) {
Slog.d(TAG, "cleanUpApplicationRecord -- " + app.pid);
if (index >= 0) { if (index >= 0) {
removeLruProcessLocked(app); removeLruProcessLocked(app);
ProcessList.remove(app.pid); ProcessList.remove(app.pid);
@@ -15005,8 +15016,10 @@ public final class ActivityManagerService extends ActivityManagerNative
if (!app.persistent || app.isolated) { if (!app.persistent || app.isolated) {
if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG, if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG,
"Removing non-persistent process during cleanup: " + app); "Removing non-persistent process during cleanup: " + app);
mProcessNames.remove(app.processName, app.uid); if (!replacingPid) {
mIsolatedProcesses.remove(app.uid); mProcessNames.remove(app.processName, app.uid);
mIsolatedProcesses.remove(app.uid);
}
if (mHeavyWeightProcess == app) { if (mHeavyWeightProcess == app) {
mHandler.sendMessage(mHandler.obtainMessage(CANCEL_HEAVY_NOTIFICATION_MSG, mHandler.sendMessage(mHandler.obtainMessage(CANCEL_HEAVY_NOTIFICATION_MSG,
mHeavyWeightProcess.userId, 0)); mHeavyWeightProcess.userId, 0));
@@ -18589,7 +18602,7 @@ public final class ActivityManagerService extends ActivityManagerNative
// Ignore exceptions. // Ignore exceptions.
} }
} }
cleanUpApplicationRecordLocked(app, false, true, -1); cleanUpApplicationRecordLocked(app, false, true, -1, false /*replacingPid*/);
mRemovedProcesses.remove(i); mRemovedProcesses.remove(i);
if (app.persistent) { if (app.persistent) {

5
services/core/java/com/android/server/am/BroadcastQueue.java
View File

@@ -264,6 +264,11 @@ public final class BroadcastQueue {
boolean didSomething = false; boolean didSomething = false;
final BroadcastRecord br = mPendingBroadcast; final BroadcastRecord br = mPendingBroadcast;
if (br != null && br.curApp.pid == app.pid) { if (br != null && br.curApp.pid == app.pid) {
if (br.curApp != app) {
Slog.e(TAG, "App mismatch when sending pending broadcast to "
+ app.processName + ", intended target is " + br.curApp.processName);
return false;
}
try { try {
mPendingBroadcast = null; mPendingBroadcast = null;
processCurBroadcastLocked(br, app); processCurBroadcastLocked(br, app);