diff options
author | Sally Qi <sallyqi@google.com> | 2023-01-25 01:53:12 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-01-25 01:53:12 +0000 |
commit | eecb9da535cb79f213c014fd494fafcd42c4ad68 (patch) | |
tree | 95b4d79a2bc3aa6d96f57b01c86eabc78600216b | |
parent | 193b8969e5ff717d7ec861bade464c158942f338 (diff) | |
parent | 03d4458ea0cb00c28f695d99aae5e4c6b15fc237 (diff) | |
download | native-eecb9da535cb79f213c014fd494fafcd42c4ad68.tar.gz |
Mitigate the security vulnerability by sanitizing the transaction flags. am: 03d4458ea0
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/20892111
Change-Id: Id8c63fb401b3642ec7c3d765171a093bbebacdb7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-rw-r--r-- | libs/gui/LayerState.cpp | 21 | ||||
-rw-r--r-- | libs/gui/include/gui/LayerState.h | 1 | ||||
-rw-r--r-- | services/surfaceflinger/SurfaceFlinger.cpp | 14 | ||||
-rw-r--r-- | services/surfaceflinger/SurfaceFlinger.h | 5 |
4 files changed, 34 insertions, 7 deletions
diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp index dfcef8fe7a..a76a21c5c4 100644 --- a/libs/gui/LayerState.cpp +++ b/libs/gui/LayerState.cpp @@ -276,6 +276,27 @@ void DisplayState::merge(const DisplayState& other) { } } +void DisplayState::sanitize(bool privileged) { + if (what & DisplayState::eLayerStackChanged) { + if (!privileged) { + what &= ~DisplayState::eLayerStackChanged; + ALOGE("Stripped attempt to set eLayerStackChanged in sanitize"); + } + } + if (what & DisplayState::eDisplayProjectionChanged) { + if (!privileged) { + what &= ~DisplayState::eDisplayProjectionChanged; + ALOGE("Stripped attempt to set eDisplayProjectionChanged in sanitize"); + } + } + if (what & DisplayState::eSurfaceChanged) { + if (!privileged) { + what &= ~DisplayState::eSurfaceChanged; + ALOGE("Stripped attempt to set eSurfaceChanged in sanitize"); + } + } +} + void layer_state_t::merge(const layer_state_t& other) { if (other.what & ePositionChanged) { what |= ePositionChanged; diff --git a/libs/gui/include/gui/LayerState.h b/libs/gui/include/gui/LayerState.h index 39dbe9e035..b73bb89791 100644 --- a/libs/gui/include/gui/LayerState.h +++ b/libs/gui/include/gui/LayerState.h @@ -267,6 +267,7 @@ struct DisplayState { DisplayState(); void merge(const DisplayState& other); + void sanitize(bool privileged); uint32_t what; sp<IBinder> token; diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp index 0d95819497..ff8653d1a3 100644 --- a/services/surfaceflinger/SurfaceFlinger.cpp +++ b/services/surfaceflinger/SurfaceFlinger.cpp @@ -3274,7 +3274,7 @@ bool SurfaceFlinger::flushTransactionQueues() { auto& [applyToken, transactionQueue] = *it; while (!transactionQueue.empty()) { - const auto& transaction = transactionQueue.front(); + auto& transaction = transactionQueue.front(); if (!transactionIsReadyToBeApplied(transaction.desiredPresentTime, transaction.states)) { setTransactionFlags(eTransactionFlushNeeded); @@ -3373,13 +3373,18 @@ void SurfaceFlinger::setTransactionState( return; } - applyTransactionState(states, displays, flags, inputWindowCommands, desiredPresentTime, + Vector<DisplayState> displaysList; + for (auto& d : displays) { + displaysList.add(d); + } + + applyTransactionState(states, displaysList, flags, inputWindowCommands, desiredPresentTime, uncacheBuffer, postTime, privileged, hasListenerCallbacks, listenerCallbacks); } void SurfaceFlinger::applyTransactionState( - const Vector<ComposerState>& states, const Vector<DisplayState>& displays, uint32_t flags, + const Vector<ComposerState>& states, Vector<DisplayState>& displays, uint32_t flags, const InputWindowCommands& inputWindowCommands, const int64_t desiredPresentTime, const client_cache_t& uncacheBuffer, const int64_t postTime, bool privileged, bool hasListenerCallbacks, const std::vector<ListenerCallbacks>& listenerCallbacks, @@ -3402,7 +3407,8 @@ void SurfaceFlinger::applyTransactionState( } } - for (const DisplayState& display : displays) { + for (DisplayState& display : displays) { + display.sanitize(privileged); transactionFlags |= setDisplayStateLocked(display); } diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h index c727574780..74b86258da 100644 --- a/services/surfaceflinger/SurfaceFlinger.h +++ b/services/surfaceflinger/SurfaceFlinger.h @@ -618,9 +618,8 @@ private: /* ------------------------------------------------------------------------ * Transactions */ - void applyTransactionState(const Vector<ComposerState>& state, - const Vector<DisplayState>& displays, uint32_t flags, - const InputWindowCommands& inputWindowCommands, + void applyTransactionState(const Vector<ComposerState>& state, Vector<DisplayState>& displays, + uint32_t flags, const InputWindowCommands& inputWindowCommands, const int64_t desiredPresentTime, const client_cache_t& uncacheBuffer, const int64_t postTime, bool privileged, bool hasListenerCallbacks, |