From eb909e3cdac752ea041d1e5af7055fd106a657c7 Mon Sep 17 00:00:00 2001
From: Dianne Hackborn <hackbod@google.com>
Date: Thu, 29 Sep 2016 14:35:15 -0700
Subject: [PATCH] Fix issue #31403654: Elevation of privilege vulnerability in
 deviceidle service

Whoops, cleared the calling identity too soon.

Change-Id: I93e3daeafafe8ee8ac92b81011f50f08a83e5229
---
 .../android/server/DeviceIdleController.java  | 56 +++++++++----------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/services/core/java/com/android/server/DeviceIdleController.java b/services/core/java/com/android/server/DeviceIdleController.java
index 488f0e793c9a8..4405c1b6135a9 100644
--- a/services/core/java/com/android/server/DeviceIdleController.java
+++ b/services/core/java/com/android/server/DeviceIdleController.java
@@ -2726,12 +2726,12 @@ public class DeviceIdleController extends SystemService
                 }
             }
         } else if ("whitelist".equals(cmd)) {
-            long token = Binder.clearCallingIdentity();
-            try {
-                String arg = shell.getNextArg();
-                if (arg != null) {
-                    getContext().enforceCallingOrSelfPermission(
-                            android.Manifest.permission.DEVICE_POWER, null);
+            String arg = shell.getNextArg();
+            if (arg != null) {
+                getContext().enforceCallingOrSelfPermission(
+                        android.Manifest.permission.DEVICE_POWER, null);
+                long token = Binder.clearCallingIdentity();
+                try {
                     do {
                         if (arg.length() < 1 || (arg.charAt(0) != '-'
                                 && arg.charAt(0) != '+' && arg.charAt(0) != '=')) {
@@ -2754,30 +2754,30 @@ public class DeviceIdleController extends SystemService
                             pw.println(getPowerSaveWhitelistAppInternal(pkg));
                         }
                     } while ((arg=shell.getNextArg()) != null);
-                } else {
-                    synchronized (this) {
-                        for (int j=0; j<mPowerSaveWhitelistAppsExceptIdle.size(); j++) {
-                            pw.print("system-excidle,");
-                            pw.print(mPowerSaveWhitelistAppsExceptIdle.keyAt(j));
-                            pw.print(",");
-                            pw.println(mPowerSaveWhitelistAppsExceptIdle.valueAt(j));
-                        }
-                        for (int j=0; j<mPowerSaveWhitelistApps.size(); j++) {
-                            pw.print("system,");
-                            pw.print(mPowerSaveWhitelistApps.keyAt(j));
-                            pw.print(",");
-                            pw.println(mPowerSaveWhitelistApps.valueAt(j));
-                        }
-                        for (int j=0; j<mPowerSaveWhitelistUserApps.size(); j++) {
-                            pw.print("user,");
-                            pw.print(mPowerSaveWhitelistUserApps.keyAt(j));
-                            pw.print(",");
-                            pw.println(mPowerSaveWhitelistUserApps.valueAt(j));
-                        }
+                } finally {
+                    Binder.restoreCallingIdentity(token);
+                }
+            } else {
+                synchronized (this) {
+                    for (int j=0; j<mPowerSaveWhitelistAppsExceptIdle.size(); j++) {
+                        pw.print("system-excidle,");
+                        pw.print(mPowerSaveWhitelistAppsExceptIdle.keyAt(j));
+                        pw.print(",");
+                        pw.println(mPowerSaveWhitelistAppsExceptIdle.valueAt(j));
+                    }
+                    for (int j=0; j<mPowerSaveWhitelistApps.size(); j++) {
+                        pw.print("system,");
+                        pw.print(mPowerSaveWhitelistApps.keyAt(j));
+                        pw.print(",");
+                        pw.println(mPowerSaveWhitelistApps.valueAt(j));
+                    }
+                    for (int j=0; j<mPowerSaveWhitelistUserApps.size(); j++) {
+                        pw.print("user,");
+                        pw.print(mPowerSaveWhitelistUserApps.keyAt(j));
+                        pw.print(",");
+                        pw.println(mPowerSaveWhitelistUserApps.valueAt(j));
                     }
                 }
-            } finally {
-                Binder.restoreCallingIdentity(token);
             }
         } else if ("tempwhitelist".equals(cmd)) {
             String opt;