From f87ea83f41c40fbbc67d3c715b13cd311ad65417 Mon Sep 17 00:00:00 2001
From: chaviw <chaviw@google.com>
Date: Wed, 20 May 2020 11:34:52 -0700
Subject: [PATCH] Clear calling identity when requesting syncInputTransaction

The syncInputTransaction can trigger a performSurfacePlacement which
could result in a callback to the client. In that case, the calling PID
will be incorrect since we didn't clear the calling identity before
requesting the performSurfacePlacement.

Bug: 154665556
Test: Hard to reproduce. Existing tests pass
Change-Id: Id7c35d356cfc435e2de225e4e0d3979751c5c7d4
Merged-In: Id7c35d356cfc435e2de225e4e0d3979751c5c7d4
---
 .../android/server/wm/WindowManagerService.java   | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index e1f85446de7bb..404863af800f3 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -7717,14 +7717,19 @@ public class WindowManagerService extends IWindowManager.Stub
 
     @Override
     public void syncInputTransactions() {
-        waitForAnimationsToComplete();
+        long token = Binder.clearCallingIdentity();
+        try {
+            waitForAnimationsToComplete();
 
-        synchronized (mGlobalLock) {
-            mWindowPlacerLocked.performSurfacePlacementIfScheduled();
-            mRoot.forAllDisplays(displayContent ->
+            synchronized (mGlobalLock) {
+                mWindowPlacerLocked.performSurfacePlacementIfScheduled();
+                mRoot.forAllDisplays(displayContent ->
                     displayContent.getInputMonitor().updateInputWindowsImmediately());
+            }
+            new SurfaceControl.Transaction().syncInputWindows().apply(true);
+        } finally {
+            Binder.restoreCallingIdentity(token);
         }
-        new SurfaceControl.Transaction().syncInputWindows().apply(true);
     }
 
     private void waitForAnimationsToComplete() {