From 5533722b9af56b707b35856d3aeccb777a1d2ae4 Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Thu, 27 Feb 2020 12:38:39 -0800
Subject: [PATCH] Fixes wrong id when granting provider access

This change passes the uid when granting implicit access to the caller
when calling a provider.

Test: manual; provider query across user bounds
Fixes: 150062663
Change-Id: I4a84febd4f5dc2f24cb2a53a1ac3b8af50772a31
---
 .../java/com/android/server/am/ActivityManagerService.java  | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index cea3bb83deb08..d444e01a76c59 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -7267,10 +7267,8 @@ public class ActivityManagerService extends IActivityManager.Stub
             }
             checkTime(startTime, "getContentProviderImpl: done!");
 
-            grantImplicitAccess(userId, null /*intent*/,
-                    UserHandle.getAppId(Binder.getCallingUid()),
-                    UserHandle.getAppId(cpi.applicationInfo.uid)
-            );
+            grantImplicitAccess(userId, null /*intent*/, callingUid,
+                    UserHandle.getAppId(cpi.applicationInfo.uid));
         }
 
         // Wait for the provider to be published...