Merge "Don't trigger DisplayAreaOrganizer events for untrusted display" into sc-dev

data/etc/services.core.protolog.json

@@ -811,12 +811,6 @@
       "group": "WM_DEBUG_RECENTS_ANIMATIONS",
       "at": "com\/android\/server\/wm\/RecentsAnimation.java"
     },
-    "-1144293044": {
-      "message": "SURFACE SET FREEZE LAYER: %s",
-      "level": "INFO",
-      "group": "WM_SHOW_TRANSACTIONS",
-      "at": "com\/android\/server\/wm\/WindowStateAnimator.java"
-    },
     "-1142279614": {
       "message": "Looking for focus: %s, flags=%d, canReceive=%b, reason=%s",
       "level": "VERBOSE",
@@ -1261,12 +1255,6 @@
       "group": "WM_DEBUG_STATES",
       "at": "com\/android\/server\/wm\/ActivityTaskSupervisor.java"
     },
-    "-639305784": {
-      "message": "Could not report config changes to the window token client.",
-      "level": "WARN",
-      "group": "WM_ERROR",
-      "at": "com\/android\/server\/wm\/WindowToken.java"
-    },
     "-639217716": {
       "message": "setFocusedApp %s displayId=%d Callers=%s",
       "level": "INFO",
@@ -1417,12 +1405,6 @@
       "group": "WM_DEBUG_KEEP_SCREEN_ON",
       "at": "com\/android\/server\/wm\/RootWindowContainer.java"
     },
-    "-477481651": {
-      "message": "SURFACE DESTROY PENDING: %s. %s",
-      "level": "INFO",
-      "group": "WM_SHOW_SURFACE_ALLOC",
-      "at": "com\/android\/server\/wm\/WindowStateAnimator.java"
-    },
     "-463348344": {
       "message": "Removing and adding activity %s to root task at top callers=%s",
       "level": "INFO",
@@ -1903,12 +1885,6 @@
       "group": "WM_DEBUG_FOCUS_LIGHT",
       "at": "com\/android\/server\/wm\/WindowManagerService.java"
     },
-    "123161180": {
-      "message": "SEVER CHILDREN",
-      "level": "INFO",
-      "group": "WM_SHOW_TRANSACTIONS",
-      "at": "com\/android\/server\/wm\/WindowSurfaceController.java"
-    },
     "140319294": {
       "message": "IME target changed within ActivityRecord",
       "level": "DEBUG",
@@ -2569,12 +2545,6 @@
       "group": "WM_DEBUG_REMOTE_ANIMATIONS",
       "at": "com\/android\/server\/wm\/RemoteAnimationController.java"
     },
-    "838570988": {
-      "message": "Could not report token removal to the window token client.",
-      "level": "WARN",
-      "group": "WM_ERROR",
-      "at": "com\/android\/server\/wm\/WindowToken.java"
-    },
     "872933199": {
       "message": "Changing focus from %s to %s displayId=%d Callers=%s",
       "level": "DEBUG",
@@ -3235,6 +3205,12 @@
       "group": "WM_DEBUG_SYNC_ENGINE",
       "at": "com\/android\/server\/wm\/BLASTSyncEngine.java"
     },
+    "1699269281": {
+      "message": "Don't organize or trigger events for untrusted displayId=%d",
+      "level": "WARN",
+      "group": "WM_DEBUG_WINDOW_ORGANIZER",
+      "at": "com\/android\/server\/wm\/DisplayAreaOrganizerController.java"
+    },
     "1720229827": {
       "message": "Creating animation bounds layer",
       "level": "INFO",

services/core/java/com/android/server/wm/DisplayArea.java

@@ -429,6 +429,10 @@ public class DisplayArea<T extends WindowContainer> extends WindowContainer<T> {
 
     void setOrganizer(IDisplayAreaOrganizer organizer, boolean skipDisplayAreaAppeared) {
         if (mOrganizer == organizer) return;
+        if (mDisplayContent == null || !mDisplayContent.isTrusted()) {
+            throw new IllegalStateException(
+                    "Don't organize or trigger events for unavailable or untrusted display.");
+        }
         IDisplayAreaOrganizer lastOrganizer = mOrganizer;
         // Update the new display area organizer before calling sendDisplayAreaVanished since it
         // could result in a new SurfaceControl getting created that would notify the old organizer

services/core/java/com/android/server/wm/DisplayAreaOrganizerController.java

@@ -100,10 +100,18 @@ public class DisplayAreaOrganizerController extends IDisplayAreaOrganizerControl
                 }
 
                 final List<DisplayAreaAppearedInfo> displayAreaInfos = new ArrayList<>();
-                mService.mRootWindowContainer.forAllDisplayAreas((da) -> {
-                    if (da.mFeatureId != feature) return;
-                    displayAreaInfos.add(organizeDisplayArea(organizer, da,
-                            "DisplayAreaOrganizerController.registerOrganizer"));
+                mService.mRootWindowContainer.forAllDisplays(dc -> {
+                    if (!dc.isTrusted()) {
+                        ProtoLog.w(WM_DEBUG_WINDOW_ORGANIZER,
+                                "Don't organize or trigger events for untrusted displayId=%d",
+                                dc.getDisplayId());
+                        return;
+                    }
+                    dc.forAllDisplayAreas((da) -> {
+                        if (da.mFeatureId != feature) return;
+                        displayAreaInfos.add(organizeDisplayArea(organizer, da,
+                                "DisplayAreaOrganizerController.registerOrganizer"));
+                    });
                 });
 
                 mOrganizersByFeatureIds.put(feature, organizer);
@@ -148,6 +156,10 @@ public class DisplayAreaOrganizerController extends IDisplayAreaOrganizerControl
                     throw new IllegalArgumentException("createTaskDisplayArea unknown displayId="
                             + displayId);
                 }
+                if (!display.isTrusted()) {
+                    throw new IllegalArgumentException("createTaskDisplayArea untrusted displayId="
+                            + displayId);
+                }
 
                 // The parentFeatureId can be either a RootDisplayArea or a TaskDisplayArea.
                 // Check if there is a RootDisplayArea with the given parentFeatureId.

services/tests/wmtests/src/com/android/server/wm/DisplayAreaOrganizerTest.java

@@ -27,6 +27,7 @@ import static com.android.dx.mockito.inline.extended.ExtendedMockito.spyOn;
 import static com.google.common.truth.Truth.assertThat;
 
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -117,6 +118,19 @@ public class DisplayAreaOrganizerTest extends WindowTestsBase {
                 () -> registerMockOrganizer(FEATURE_VENDOR_FIRST));
     }
 
+    @Test
+    public void testRegisterOrganizer_ignoreUntrustedDisplay() throws RemoteException {
+        doReturn(false).when(mDisplayContent).isTrusted();
+
+        final IDisplayAreaOrganizer organizer = createMockOrganizer(new Binder());
+        List<DisplayAreaAppearedInfo> infos = mOrganizerController
+                .registerOrganizer(organizer, FEATURE_VENDOR_FIRST).getList();
+
+        assertThat(infos).isEmpty();
+        verify(organizer, never()).onDisplayAreaAppeared(any(DisplayAreaInfo.class),
+                any(SurfaceControl.class));
+    }
+
     @Test
     public void testCreateTaskDisplayArea_topBelowRoot() {
         final String newTdaName = "testTda";
@@ -186,13 +200,20 @@ public class DisplayAreaOrganizerTest extends WindowTestsBase {
     @Test
     public void testCreateTaskDisplayArea_invalidDisplayAndRoot() {
         final IDisplayAreaOrganizer organizer = createMockOrganizer(new Binder());
+
         assertThrows(IllegalArgumentException.class, () ->
                 mOrganizerController.createTaskDisplayArea(
                         organizer, SystemServicesTestRule.sNextDisplayId + 1, FEATURE_ROOT,
                         "testTda"));
+
         assertThrows(IllegalArgumentException.class, () ->
                 mOrganizerController.createTaskDisplayArea(
                         organizer, DEFAULT_DISPLAY, FEATURE_ROOT - 1, "testTda"));
+
+        doReturn(false).when(mDisplayContent).isTrusted();
+        assertThrows(IllegalArgumentException.class, () ->
+                mOrganizerController.createTaskDisplayArea(
+                        organizer, DEFAULT_DISPLAY, FEATURE_ROOT, "testTda"));
     }
 
     @Test