Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
257,449 Commits 3 Branches 0 Tags
2fe1990ba779ef3fdb77cc596ff9eefeaeef613d
Commit Graph

257449 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Fyodor Kupolov
2fe1990ba7 [DO NOT MERGE] Increased user switch timeout to 3s 
Also report the actual delay if sendResult is eventually called.

Test: Manual - device boots, no timeouts
Bug: 30813554
Change-Id: I1271181ab9d2653fad1167049c84a6780ad46ff0
 2016-12-08 17:49:09 -08:00
Bill Napier
31f2e91892 Revert "Fix vulnerability in MemoryIntArray am: a97171ec49" am: 43966dafb3 am: 498547ec6c 
am: ef435f6780

Change-Id: Ib5c8b17acafa4a2c55666c2dbc1591bbbeac51a7
 2016-12-08 22:40:05 +00:00
Bill Napier
ef435f6780 Revert "Fix vulnerability in MemoryIntArray am: a97171ec49" am: 43966dafb3 
am: 498547ec6c

Change-Id: I8874250d553a7271305efc3f027c933e4aad3b1d
 2016-12-08 22:34:34 +00:00
Bill Napier
498547ec6c Revert "Fix vulnerability in MemoryIntArray am: a97171ec49" 
am: 43966dafb3

Change-Id: I01bc83edd411dc39cb696e64ea35b5d4a8497fbf
 2016-12-08 22:30:02 +00:00
Bill Napier
43966dafb3 Revert "Fix vulnerability in MemoryIntArray am: a97171ec49" 
This reverts commit fb12dd509f.

Change-Id: I9e1b22b8df0e754095541a758096cba279a81ab1
 2016-12-08 22:22:38 +00:00
Svetoslav Ganov
49e3ce4800 Fix vulnerability in MemoryIntArray am: a97171ec49 am: fb12dd509f am: a5ee109029 
am: 5250d90637

Change-Id: I08c3a670598d8d26694b7d282d0bd18ffb4faf9b
 2016-12-08 21:51:00 +00:00
Svetoslav Ganov
5250d90637 Fix vulnerability in MemoryIntArray am: a97171ec49 am: fb12dd509f 
am: a5ee109029

Change-Id: If1b852faa812b0bcb7419ae0f75a3e2349926de0
 2016-12-08 21:46:34 +00:00
Svetoslav Ganov
a5ee109029 Fix vulnerability in MemoryIntArray am: a97171ec49 
am: fb12dd509f

Change-Id: I269ec7d61ebdc9f485d759d1398d5fa4eacf868f
 2016-12-08 21:42:05 +00:00
Svetoslav Ganov
fb12dd509f Fix vulnerability in MemoryIntArray 
am: a97171ec49

Change-Id: Ifa2221a9b8ca705ef0239d61772938ac11761ce2
 2016-12-08 21:37:33 +00:00
Svetoslav Ganov
a97171ec49 Fix vulnerability in MemoryIntArray 
MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

 Further, we now check the memory mapped size against
 the size of the underlying ashmem region after we do
 the memory mapping (to fix the ahsmem size) and if
 an attacker changed the size under us we throw.

 Tests: Updated the tests and they pass.

 bug:33039926
 bug:33042690

Change-Id: I1004579181ff7a223ef659e85c46100c47ab2409
 2016-12-08 11:51:26 -08:00
Bill Yi
462d9a3335 Merge "Import translations. DO NOT MERGE" into cw-f-dev 
am: c0b7e766b0  -s ours

Change-Id: I00f0418ff736f2cb861ae7f1339f9ed477215b74
 2016-12-08 17:16:51 +00:00
Bill Yi
f1a5ffbf99 Import translations. DO NOT MERGE 
am: b004945727  -s ours

Change-Id: I4287af7000efb01c1203276a6e1817f52504a560
 2016-12-08 17:16:49 +00:00
Bill Yi
f014d755a1 Merge "Import translations. DO NOT MERGE" into cw-f-dev 
am: e1add91fa1  -s ours

Change-Id: I3c99e350f7130ea39ac29751f104fafc04dde0d2
 2016-12-08 17:15:12 +00:00
Bill Yi
a40b64efdd Import translations. DO NOT MERGE 
am: c30efc0214  -s ours

Change-Id: I93c5e34494eb4d3cb56ca3652406cc2a24d62fd4
 2016-12-08 17:15:09 +00:00
Bill Yi
a62eff1f94 Merge "Import translations. DO NOT MERGE" into cw-f-dev 
am: 7e212ae873  -s ours

Change-Id: I14cbe78cdcb23fd8f82103395f057dca03a3b171
 2016-12-08 17:13:32 +00:00
Bill Yi
83810d0665 Import translations. DO NOT MERGE 
am: c300be1cf4  -s ours

Change-Id: I4318b5a4b5d6f927c03696cfe2ee52f5940bbe99
 2016-12-08 17:13:31 +00:00
Bill Yi
217e5fc476 Merge "Import translations. DO NOT MERGE" into cw-f-dev 
am: df9a47a79f  -s ours

Change-Id: I5bf1a9de6b0539b8115fb89c738ef903736c9cb4
 2016-12-08 17:12:00 +00:00
Bill Yi
ec82e05e7b Import translations. DO NOT MERGE 
am: ef89f62670  -s ours

Change-Id: Ia2a1482ed04988a1d47940402ec868c25e8bd95f
 2016-12-08 17:11:59 +00:00
Bill Yi
19e2b518ff Merge "Import translations. DO NOT MERGE" into cw-f-dev 
am: 3c54cdf15e  -s ours

Change-Id: I4cdda925e378df0b674bae5c01ab9118d91d0dce
 2016-12-08 17:08:12 +00:00
Bill Yi
c52c508e8c Import translations. DO NOT MERGE 
am: d4bdbc314b  -s ours

Change-Id: Ib09ce8f953d127e4fdccaf3848f78678dc1f56b4
 2016-12-08 17:08:10 +00:00
TreeHugger Robot
c0b7e766b0 Merge "Import translations. DO NOT MERGE" into cw-f-dev 2016-12-08 17:00:40 +00:00
TreeHugger Robot
e1add91fa1 Merge "Import translations. DO NOT MERGE" into cw-f-dev 2016-12-08 17:00:14 +00:00
TreeHugger Robot
7e212ae873 Merge "Import translations. DO NOT MERGE" into cw-f-dev 2016-12-08 16:59:47 +00:00
TreeHugger Robot
df9a47a79f Merge "Import translations. DO NOT MERGE" into cw-f-dev 2016-12-08 16:59:19 +00:00
TreeHugger Robot
3c54cdf15e Merge "Import translations. DO NOT MERGE" into cw-f-dev 2016-12-08 16:58:52 +00:00
Bill Yi
d4bdbc314b Import translations. DO NOT MERGE 
Change-Id: Iaf10ebaae14bf032c8e6ee512c3968c970b6438e
Auto-generated-cl: translation import
 2016-12-07 23:47:19 -08:00
Bill Yi
ef89f62670 Import translations. DO NOT MERGE 
Change-Id: I82ffbc76e650cbe5b782ad8ff4a257270d11b03f
Auto-generated-cl: translation import
 2016-12-07 23:21:48 -08:00
Bill Yi
c300be1cf4 Import translations. DO NOT MERGE 
Change-Id: Ifebc058ab8d5b151e49ef51ea2fd895817d70bd9
Auto-generated-cl: translation import
 2016-12-07 23:18:44 -08:00
Bill Yi
c30efc0214 Import translations. DO NOT MERGE 
Change-Id: I1b1c0c189c1979a7a885b4e6e6fef21bae6dd22a
Auto-generated-cl: translation import
 2016-12-07 23:00:43 -08:00
Bill Yi
b004945727 Import translations. DO NOT MERGE 
Change-Id: I4de79adeee71e5aa9f9055d09f6a6dd14d6a5dec
Auto-generated-cl: translation import
 2016-12-07 22:46:57 -08:00
Svetoslav Ganov
061d2b6cad Revert "Fix vulnerability in MemoryIntArray" am: 1f06508bc6 am: 64b5725900 am: 60357eb6bd 
am: 590b77da13

Change-Id: Ic676846ed4e671535ed79cbec39ab33ad52c97f1
 2016-12-08 02:40:55 +00:00
Svetoslav Ganov
590b77da13 Revert "Fix vulnerability in MemoryIntArray" am: 1f06508bc6 am: 64b5725900 
am: 60357eb6bd

Change-Id: Ib81f6d25a1f59c14f47fe79325c95b02c7cbe639
 2016-12-08 02:36:54 +00:00
Svetoslav Ganov
60357eb6bd Revert "Fix vulnerability in MemoryIntArray" am: 1f06508bc6 
am: 64b5725900

Change-Id: Id7021fb02059cfb3bb9184ef24f417c0be7f55b9
 2016-12-08 02:33:00 +00:00
Svetoslav Ganov
64b5725900 Revert "Fix vulnerability in MemoryIntArray" 
am: 1f06508bc6

Change-Id: Id387817495b1857f304203c8487da3db49bdd0e4
 2016-12-08 02:29:00 +00:00
Svetoslav Ganov
1f06508bc6 Revert "Fix vulnerability in MemoryIntArray" 
This reverts commit 4694cad511.

Change-Id: I235ea3c4bd86d90bf97bc1a2d023f4780251e570
 2016-12-08 02:17:40 +00:00
Svetoslav Ganov
6023fd1800 Fix vulnerability in MemoryIntArray am: 4694cad511 am: ec40a70ffb am: 138a541eaa 
am: 557858b9c0

Change-Id: Ia6b6b59be28f938f4c3a7c4aecb035fd4c6607f6
 2016-12-08 02:08:23 +00:00
Aart Bik
116a4e883d Revert "Fix vulnerability in MemoryIntArray" am: 29139a8ae5 am: 86699f980f am: 65cf055ad9 
am: 278cad4793

Change-Id: I545ba917e74f34716fe773250468e06b1dfd8312
 2016-12-08 02:00:56 +00:00
Svetoslav Ganov
557858b9c0 Fix vulnerability in MemoryIntArray am: 4694cad511 am: ec40a70ffb 
am: 138a541eaa

Change-Id: I659d82f39cab9f6d73ceb118cdc74307ee995dfb
 2016-12-08 02:00:55 +00:00
Svetoslav Ganov
138a541eaa Fix vulnerability in MemoryIntArray am: 4694cad511 
am: ec40a70ffb

Change-Id: I5d03aaa04fe13b3af20bcc61e9bb925b471ab825
 2016-12-08 01:56:24 +00:00
Aart Bik
278cad4793 Revert "Fix vulnerability in MemoryIntArray" am: 29139a8ae5 am: 86699f980f 
am: 65cf055ad9

Change-Id: Iae6e4fe6eada607d71a20b8ea588ee8efd56a8e0
 2016-12-08 01:52:51 +00:00
TreeHugger Robot
1e1d5b07a6 Merge "EmergencyCryptkeeperText: Make sure we update if airplane mode changes" into nyc-mr2-dev 2016-12-08 01:50:14 +00:00
Svetoslav Ganov
ec40a70ffb Fix vulnerability in MemoryIntArray 
am: 4694cad511

Change-Id: I64257a851c06e4a333056ee132ff8a2ea29aef5c
 2016-12-08 01:49:21 +00:00
Aart Bik
65cf055ad9 Revert "Fix vulnerability in MemoryIntArray" am: 29139a8ae5 
am: 86699f980f

Change-Id: I7876874ba0d6815920f21021a47e3fe1b3e1c42f
 2016-12-08 01:44:54 +00:00
Aart Bik
86699f980f Revert "Fix vulnerability in MemoryIntArray" 
am: 29139a8ae5

Change-Id: I3975cfc51bd03a65855c113dfdb827d24471e0ba
 2016-12-08 01:36:50 +00:00
Svetoslav Ganov
4694cad511 Fix vulnerability in MemoryIntArray 
MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.

Tests: Updated the tests and they pass.

bug:33039926
bug:33042690

Change-Id: Id7f0e8a4c861b0b9fa796767e0c22d96633b14d1
 2016-12-08 01:35:08 +00:00
Aart Bik
29139a8ae5 Revert "Fix vulnerability in MemoryIntArray" 
This reverts commit 86dfa094de.


BROKE BUILD (as shown in some treehugger builds)

frameworks/base/core/java/android/util/MemoryIntArray.java:84: error: cannot find symbol
        mCloseGuard.open("close");
        ^
        
       
bug:33039926
bug:33042690

Change-Id: Ief875e543ec849fe55c747fb1ed5253f0cd9a122
 2016-12-08 01:12:48 +00:00
Svetoslav Ganov
9aed2f6f53 Fix vulnerability in MemoryIntArray am: 86dfa094de am: 367023218e am: e123f41553 
am: b317e60014

Change-Id: I550293e05ce1d1039e3f22f72002e69df919f735
 2016-12-08 01:04:48 +00:00
Svetoslav Ganov
b317e60014 Fix vulnerability in MemoryIntArray am: 86dfa094de am: 367023218e 
am: e123f41553

Change-Id: Id5cd6072d972b5d03512e83dc342a7c78341ffeb
 2016-12-08 00:57:21 +00:00
Svetoslav Ganov
e123f41553 Fix vulnerability in MemoryIntArray am: 86dfa094de 
am: 367023218e

Change-Id: I38d3f7089b9678210772f79215b44198b262e922
 2016-12-08 00:49:48 +00:00
Daniel Nishi
652276ca3f Merge "Add methods to query the private storage." into nyc-mr2-dev 2016-12-08 00:42:25 +00:00