OSDN Git Service
Jeff Sharkey [Mon, 21 Nov 2016 17:33:54 +0000 (10:33 -0700)]
DO NOT MERGE. No direct Uri grants from system.
The system should never be extending Uri permission grants from
itself, since it automatically holds all the permissions. Instead,
the system should always be a mediator between two specific app, and
it should be using startActivityAsCaller() if it needs to extend
permissions.
Blocking at this level fixes an entire class of confused deputy
security issues.
Test: builds, normal intent resolution UI works
Bug:
33019296,
32990341,
32879915,
32879772
Change-Id: Iaa57c393a386d8068e807d0dd0caccc89d8a11db
Suprabh Shukla [Thu, 2 Feb 2017 02:38:24 +0000 (02:38 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
4ffe72dcc8 am:
ab8d3febd3 am:
2e6bdbeaab
am:
588411fc7c -s ours
Change-Id: I1511e5dff681d06161cd18b78e7edaf7eddb897a
Suprabh Shukla [Thu, 2 Feb 2017 02:32:48 +0000 (02:32 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
4ffe72dcc8 am:
ab8d3febd3
am:
2e6bdbeaab
Change-Id: I7e286445a887e467a7de42ce9b27a9dc009e47fd
Suprabh Shukla [Thu, 2 Feb 2017 02:28:13 +0000 (02:28 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
4ffe72dcc8
am:
ab8d3febd3
Change-Id: If42411391fe2010162c51adf48e720e308a650ec
Suprabh Shukla [Thu, 2 Feb 2017 02:21:16 +0000 (02:21 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
am:
4ffe72dcc8
Change-Id: Ic7b9ef6484df0b57c8f1ee7a483ef3bda05c7cc7
Makoto Onuki [Wed, 4 Jan 2017 22:36:59 +0000 (14:36 -0800)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
Note DPM.wipeData() on a secondary user is now blocking, just like
it's been always blocking on the primary user.
Test: Manually tested wipeData() with ApiDemos, both on 1) the primary user,
2) a secondary user and 3) work profile.
Test: adb shell am instrument -e class com.android.server.devicepolicy.DevicePolicyManagerTest -w com.android.frameworks.servicestests
Bug
30681079
Change-Id: Ia832bed0f22396998d6307ab46e262dae9463838
Merged-in: Ia832bed0f22396998d6307ab46e262dae9463838
(cherry picked from commit
efdec8f5688ce6b0a287eddb6d5dad93ffa0e1ee)
Suprabh Shukla [Tue, 31 Jan 2017 21:01:28 +0000 (13:01 -0800)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
Note DPM.wipeData() on a secondary user is now blocking, just like
it's been always blocking on the primary user.
Bug
30681079
Change-Id: Ia832bed0f22396998d6307ab46e262dae9463838
Kenny Guy [Tue, 17 Jan 2017 23:33:41 +0000 (23:33 +0000)]
Fix issue with saving admins before finishing loading.
Saving device policy managers settings to clear out
password stats was happening before initializing mAdminList
so could wipe active admins.
Test: manual - flash with N2G05C add google account with dmagent flash wth this fix, check dmagent is still an active admin, reboot check admin is still active.
Test: runtest -c com.android.server.devicepolicy.DevicePolicyManagerTest frameworks-services
Bug:
34277435
Change-Id: I13660b47f30e9aba001eb13f2e457c3b3f36da3e
(cherry picked from commit
adbda7474cc1968b66e9948aee566dc346e71340)
Andrew Scull [Fri, 13 Jan 2017 12:18:42 +0000 (12:18 +0000)]
Merge "Don't save password metrics to disk." into nyc-dev
Andrew Scull [Fri, 2 Dec 2016 16:08:09 +0000 (16:08 +0000)]
Don't save password metrics to disk.
On FBE devices, don't save the metrics to disk but compute them when the
password is first entered and only store them in RAM.
Merged-in:
5daf273b7e3272269c53eda20ce494d0e7a365b5
Bug:
32793550
Change-Id: Icee7f615167761177b224b342970a36c7d90f6ba
David Friedman [Sat, 7 Jan 2017 02:24:54 +0000 (02:24 +0000)]
Merge "Docs: Updates Javadoc documentation. Bug:
32532540" into nyc-dev
Dave Friedman [Thu, 5 Jan 2017 02:27:26 +0000 (18:27 -0800)]
Docs: Updates Javadoc documentation.
Bug:
32532540
Change-Id: Ia811d9a51812206b18b75a98f6c5a55b92627404
Kevin Hufnagle [Wed, 4 Jan 2017 01:28:19 +0000 (01:28 +0000)]
docs: Added descriptions of IAB subscription-specific settings. am:
145b377b38
am:
4418907d50
Change-Id: I486f53410a427f373daec719bac522289d812e7a
Kevin Hufnagle [Wed, 4 Jan 2017 01:24:24 +0000 (01:24 +0000)]
docs: Added descriptions of IAB subscription-specific settings.
am:
145b377b38
Change-Id: I1b7a0885f613beb9b7baba8a6b35b59f00989ff3
Kevin Hufnagle [Wed, 4 Jan 2017 01:14:21 +0000 (01:14 +0000)]
Merge "docs: Added note - test subscriptions cannot use reserved IDs" into nyc-dev
Charles He [Thu, 29 Dec 2016 10:37:45 +0000 (10:37 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev am:
63a27d773b am:
1422a6074d am:
a1d59972ad am:
f027831c6b am:
5c74a1e9bb
am:
1d84f619bf
Change-Id: Ic189edc98c3079ca98b258d08a5821b9c97dc027
Charles He [Thu, 29 Dec 2016 10:36:32 +0000 (10:36 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable. am:
71d2a41dd9 am:
d0339c6e8f am:
6aa436bef2 am:
76ca2da7e8 am:
0cc0219089
am:
ced5ab190c
Change-Id: I59602f83fd659ce5192636d0e66feae217997d7c
Charles He [Thu, 29 Dec 2016 10:35:19 +0000 (10:35 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev am:
4bd97eb888 am:
a8484b4f92 am:
d7f2a4b0c7 am:
b64af9bacd am:
e15e0de7e5
am:
6bb6f02a15
Change-Id: I849811a3be2c6989edea3ed6f938b4b36a4fabe7
Charles He [Thu, 29 Dec 2016 10:34:04 +0000 (10:34 +0000)]
Prevent writing to FRP partition during factory reset. am:
a9437bd1ca am:
2ce5c4320d am:
133ff4d611 am:
00a581f882 am:
e5156ec1e9
am:
9a47fa7fc0
Change-Id: Ifb9f5b177f7c031352e6e9cf308e6295f7c60074
Charles He [Thu, 29 Dec 2016 10:28:57 +0000 (10:28 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev am:
63a27d773b am:
1422a6074d am:
a1d59972ad am:
f027831c6b
am:
5c74a1e9bb
Change-Id: Ie15d3c1927f17a36ed6d6bbe4b96c986536be3c7
Charles He [Thu, 29 Dec 2016 10:27:52 +0000 (10:27 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable. am:
71d2a41dd9 am:
d0339c6e8f am:
6aa436bef2 am:
76ca2da7e8
am:
0cc0219089
Change-Id: Id72d64d9356e362f35062bc6e45071b2be308558
Charles He [Thu, 29 Dec 2016 10:26:51 +0000 (10:26 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev am:
4bd97eb888 am:
a8484b4f92 am:
d7f2a4b0c7 am:
b64af9bacd
am:
e15e0de7e5
Change-Id: I12af619f1fce710f643387dca3e06c1c4b5258d3
Charles He [Thu, 29 Dec 2016 10:25:50 +0000 (10:25 +0000)]
Prevent writing to FRP partition during factory reset. am:
a9437bd1ca am:
2ce5c4320d am:
133ff4d611 am:
00a581f882
am:
e5156ec1e9
Change-Id: I62b79fe7ef5a2febce27729f4709a599832cb3da
Charles He [Thu, 29 Dec 2016 10:21:47 +0000 (10:21 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev am:
63a27d773b am:
1422a6074d am:
a1d59972ad
am:
f027831c6b
Change-Id: I49d10d41d5b89c97a2f418ccaed44eeae720bb22
Charles He [Thu, 29 Dec 2016 10:20:47 +0000 (10:20 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable. am:
71d2a41dd9 am:
d0339c6e8f am:
6aa436bef2
am:
76ca2da7e8
Change-Id: I9e20b2954ccb462cee31cb5ea44986c00afadbff
Charles He [Thu, 29 Dec 2016 10:19:49 +0000 (10:19 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev am:
4bd97eb888 am:
a8484b4f92 am:
d7f2a4b0c7
am:
b64af9bacd
Change-Id: I261c46544e8e1aef26772d57475037810198e4d9
Charles He [Thu, 29 Dec 2016 10:18:49 +0000 (10:18 +0000)]
Prevent writing to FRP partition during factory reset. am:
a9437bd1ca am:
2ce5c4320d am:
133ff4d611
am:
00a581f882
Change-Id: I016955744e48d7a91380c2ff39f7c64536a39c7e
Charles He [Thu, 29 Dec 2016 10:14:26 +0000 (10:14 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev am:
63a27d773b am:
1422a6074d
am:
a1d59972ad
Change-Id: I027ab6594b563204515677fca9c256251b7067cd
Charles He [Thu, 29 Dec 2016 10:13:27 +0000 (10:13 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable. am:
71d2a41dd9 am:
d0339c6e8f
am:
6aa436bef2
Change-Id: I994b2fe070091a32beffff9dbf11b907b7878fe8
Charles He [Thu, 29 Dec 2016 10:12:24 +0000 (10:12 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev am:
4bd97eb888 am:
a8484b4f92
am:
d7f2a4b0c7
Change-Id: I3019f9751b69809d3cb66061753f0b76085b235b
Charles He [Thu, 29 Dec 2016 10:11:20 +0000 (10:11 +0000)]
Prevent writing to FRP partition during factory reset. am:
a9437bd1ca am:
2ce5c4320d
am:
133ff4d611
Change-Id: I54b163f645f561243aac3df1a55c1023531997b3
Charles He [Thu, 29 Dec 2016 10:07:20 +0000 (10:07 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev am:
63a27d773b
am:
1422a6074d
Change-Id: I2f3bf02f57c5f00964e645321467977b4ef498a7
Charles He [Thu, 29 Dec 2016 10:06:14 +0000 (10:06 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable. am:
71d2a41dd9
am:
d0339c6e8f
Change-Id: I0dbec3edf704821eb4605a48b770461eb99ddae7
Charles He [Thu, 29 Dec 2016 10:05:02 +0000 (10:05 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev am:
4bd97eb888
am:
a8484b4f92
Change-Id: Id5a9576ab6e37e3744a59d904909d11f668d0e06
Charles He [Thu, 29 Dec 2016 10:03:53 +0000 (10:03 +0000)]
Prevent writing to FRP partition during factory reset. am:
a9437bd1ca
am:
2ce5c4320d
Change-Id: I29339a634fd22cd46bfc08619464da8fe159a2b7
Charles He [Thu, 29 Dec 2016 09:50:26 +0000 (09:50 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev
am:
63a27d773b
Change-Id: I01d332678c1c3fe57ed36062a9ed01b5f368a55d
Charles He [Thu, 29 Dec 2016 09:50:20 +0000 (09:50 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable.
am:
71d2a41dd9
Change-Id: Iab575b1efdd720c9cf9e32e0b056c99eff98deab
Charles He [Thu, 29 Dec 2016 09:48:50 +0000 (09:48 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev
am:
4bd97eb888
Change-Id: I607f7ca9e160c4eed69a5baeff6b31d6db7c6b03
Charles He [Thu, 29 Dec 2016 09:48:45 +0000 (09:48 +0000)]
Prevent writing to FRP partition during factory reset.
am:
a9437bd1ca
Change-Id: Ib0b8db2357317dc3e680910c08f15f098baf2af9
Charles He [Thu, 29 Dec 2016 09:43:10 +0000 (09:43 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev
Charles He [Thu, 29 Dec 2016 09:42:25 +0000 (09:42 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev
Tom O'Neill [Thu, 22 Dec 2016 17:44:46 +0000 (17:44 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b am:
1684e5f344 am:
d28eef0cc2 am:
1f458fdc66 am:
d82f8a67fc am:
1ac8affd51
am:
56098f81b6
Change-Id: I14fcacaede569580c8ca8e5bbbebb408ddcce76a
Tom O'Neill [Thu, 22 Dec 2016 17:39:18 +0000 (17:39 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b am:
1684e5f344 am:
d28eef0cc2 am:
1f458fdc66 am:
d82f8a67fc
am:
1ac8affd51
Change-Id: I965c900e266a9189c595612cef6ddac839498949
Tom O'Neill [Thu, 22 Dec 2016 17:34:11 +0000 (17:34 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b am:
1684e5f344 am:
d28eef0cc2 am:
1f458fdc66
am:
d82f8a67fc
Change-Id: I25e43680e464c5169e8a5b9e8151b0dab2d2cf86
Tom O'Neill [Thu, 22 Dec 2016 17:29:05 +0000 (17:29 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b am:
1684e5f344 am:
d28eef0cc2
am:
1f458fdc66
Change-Id: I61d4b25ee0264397693f30e2091997c058d0c5fc
Tom O'Neill [Thu, 22 Dec 2016 17:23:39 +0000 (17:23 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b am:
1684e5f344
am:
d28eef0cc2
Change-Id: If937d91cee2bb06406cf3cd1ae6ac3402a51e88d
Tom O'Neill [Thu, 22 Dec 2016 17:19:10 +0000 (17:19 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516 am:
0a8978f04b
am:
1684e5f344
Change-Id: I0ebd2856e2e2f3793273ba952b44dc77e85b021e
Tom O'Neill [Thu, 22 Dec 2016 17:14:05 +0000 (17:14 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516
am:
0a8978f04b
Change-Id: I693665a57465ec57f946fad57cda9ce48389408f
Tom O'Neill [Thu, 22 Dec 2016 17:09:09 +0000 (17:09 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872
am:
3380a77516
Change-Id: Ice61f337e1fcfd0569431538e475d94f9d205423
Tom O'Neill [Thu, 22 Dec 2016 17:04:07 +0000 (17:04 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e
am:
d417e54872
Change-Id: I2f47020055f962b36f095137d75c9cbfe6b1a6db
Tom O'Neill [Thu, 22 Dec 2016 16:58:33 +0000 (16:58 +0000)]
Fix exploit where can hide the fact that a location was mocked
am:
a206a0f17e
Change-Id: Ib3af056919a4b909d3d11dd3fe2b46eaa7cdf0f4
Joe Fernandez [Sat, 17 Dec 2016 02:20:56 +0000 (18:20 -0800)]
docs: Add deprecation message for the developer.android.com docs
Change-Id: Ia091df49099482696abbc3a596cf1787ca904d67
Svet Ganov [Thu, 15 Dec 2016 22:51:17 +0000 (14:51 -0800)]
[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file
bug:
33039926
bug:
33042690
Change-Id: If0431b77ec546c72f8cc25bb605a851572bb22a6
Tom O'Neill [Thu, 15 Dec 2016 18:26:28 +0000 (10:26 -0800)]
Fix exploit where can hide the fact that a location was mocked
- Even if call setTestProviderLocation() with inconsistent providers,
should still end up with a location that is flagged as mocked
- Bug:
33091107
Change-Id: I39e038f25b975989c2e8651bfd9ec9e74073e6cd
Julius D'souza [Wed, 14 Dec 2016 19:00:38 +0000 (19:00 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController am:
e6f8cb29ec -s ours
am:
7a69e8f3d8
Change-Id: I581e1cd6ef0dec7042802b29dd76db8ffc02cec3
Julius D'souza [Wed, 14 Dec 2016 18:54:02 +0000 (18:54 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController
am:
e6f8cb29ec -s ours
Change-Id: Ia7bdba0fd3d52bb2d7c33f81d376336563f3a5cb
Julius D'souza [Wed, 14 Dec 2016 18:30:25 +0000 (10:30 -0800)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController
Bug:
31900521
Change-Id: I9484b10f0e6b99dfaf11266bb275a31d7ff3868c
Julius D'souza [Wed, 14 Dec 2016 17:51:28 +0000 (17:51 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle. am:
f9f39cc4a8 -s ours
am:
589f83e686 -s ours
Change-Id: I76a619ed9824174735d0a86c55fe13a3d6e90ec5
Julius D'souza [Wed, 14 Dec 2016 17:44:27 +0000 (17:44 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle.
am:
f9f39cc4a8 -s ours
Change-Id: Ibd0b18a9e833afcc85845f4db57a927e80739cc2
Charles He [Thu, 1 Dec 2016 19:22:33 +0000 (19:22 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable.
Change-Id: I1024f2a56badde5c123d025d6fe02f42559cbcb1
Test: manual
Bug:
30352311
(cherry picked from commit
f6f1d627483b4dad9d65176769a1ee92c59a4810)
Charles He [Thu, 24 Nov 2016 14:05:00 +0000 (14:05 +0000)]
Prevent writing to FRP partition during factory reset.
Avoid potential race condition between FRP wipe and write operations
during factory reset by making the FRP partition unwritable after
wipe.
Bug:
30352311
Test: manual
Change-Id: If3f024a1611366c0677a996705724458094fcfad
(cherry picked from commit
a629c772f4a7a5ddf7ff9f78fb19f7ab86c2a9c2)
Julius D'souza [Tue, 13 Dec 2016 01:15:17 +0000 (17:15 -0800)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController
is going idle.
The inputs to DeviceIdleController (alarm manager, sensors)
hold wake locks while they call it. But then the real work
happens in a handler which is outside of the wakelock, so
listeners don't get a chance to run right away, which in
the case of NetworkPolicyManager means the device is in a
higher power state than it should be.
It's not clear that this will 100% fix the bug, because
NetworkPolicyManagerService also has its own internal
Handler, and isn't holding its own wakelock for this,
but this change allows NPMS to be fixed if it really
needed to be.
Bug:
31900521
Change-Id: I706045aa189147824c9214c57abc13993aee9a5b
Svetoslav Ganov [Thu, 8 Dec 2016 19:48:19 +0000 (11:48 -0800)]
Fix vulnerability in MemoryIntArray
MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.
Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.
Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.
Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.
Tests: Updated the tests and they pass.
bug:
33039926
bug:
33042690
Change-Id: I1004579181ff7a223ef659e85c46100c47ab2409
Svetoslav Ganov [Thu, 8 Dec 2016 02:17:40 +0000 (02:17 +0000)]
Revert "Fix vulnerability in MemoryIntArray"
This reverts commit
4694cad51122c20880d00389ef95833d7a14b358.
Change-Id: I235ea3c4bd86d90bf97bc1a2d023f4780251e570
Svetoslav Ganov [Thu, 8 Dec 2016 01:30:38 +0000 (01:30 +0000)]
Fix vulnerability in MemoryIntArray
MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.
Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.
Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.
Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.
Tests: Updated the tests and they pass.
bug:
33039926
bug:
33042690
Change-Id: Id7f0e8a4c861b0b9fa796767e0c22d96633b14d1
Aart Bik [Thu, 8 Dec 2016 01:05:35 +0000 (01:05 +0000)]
Revert "Fix vulnerability in MemoryIntArray"
This reverts commit
86dfa094de773670743d41c3e3156eace8e403a3.
BROKE BUILD (as shown in some treehugger builds)
frameworks/base/core/java/android/util/MemoryIntArray.java:84: error: cannot find symbol
mCloseGuard.open("close");
^
bug:
33039926
bug:
33042690
Change-Id: Ief875e543ec849fe55c747fb1ed5253f0cd9a122
Svetoslav Ganov [Wed, 7 Dec 2016 23:19:09 +0000 (15:19 -0800)]
Fix vulnerability in MemoryIntArray
MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.
Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.
Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.
Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.
Tests: Updated the tests and they pass.
bug:
33039926
bug:
33042690
Change-Id: Ie267646eb88014034fbd048d7a9bc273420c7eff
Jeff Sharkey [Fri, 2 Dec 2016 19:46:36 +0000 (19:46 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours am:
ce477912a2 am:
920b02a94f -s ours am:
aff9286bd6 am:
37ff2d56bf am:
56247334f8
am:
923aef8e02 -s ours
Change-Id: Ia0d0ac5ed1f8a84bd9158530fde499f91ac7f411
Jeff Sharkey [Fri, 2 Dec 2016 19:45:33 +0000 (19:45 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours am:
9277cce7fa am:
a1d1ecbe05 -s ours am:
928c09cd8e am:
5267b63325 am:
a51ebb828a
am:
acfda3d71a -s ours
Change-Id: I0857c3cdd2e471ad04dbafc22a7898168a615a24
Jeff Sharkey [Fri, 2 Dec 2016 19:44:38 +0000 (19:44 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am:
6b89229d14 am:
a7efe16fe1 -s ours am:
f1085f2dc8 am:
c130d7fd5e am:
948841362a
am:
7e54dc58d4 -s ours
Change-Id: I3dce2baad70e1d9d606c27534f4ff4e9435f2445
Jeff Sharkey [Fri, 2 Dec 2016 19:43:33 +0000 (19:43 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
91add43ae7 am:
792d49dfb5 -s ours am:
32af84320b am:
8b5fa0c0c0 am:
d081cb0ab7
am:
cd35e746dc -s ours
Change-Id: I12608bbd9173dc053df967174bc59f9297a151c2
Jeff Sharkey [Fri, 2 Dec 2016 19:29:15 +0000 (19:29 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours am:
ce477912a2 am:
920b02a94f -s ours am:
aff9286bd6 am:
37ff2d56bf
am:
56247334f8
Change-Id: I8bf5769fbb68fb10a4acd2c557dc1c66a3c448df
Jeff Sharkey [Fri, 2 Dec 2016 19:28:18 +0000 (19:28 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours am:
9277cce7fa am:
a1d1ecbe05 -s ours am:
928c09cd8e am:
5267b63325
am:
a51ebb828a
Change-Id: Ic67fac2e28ab776632a98e3556c46826d7335a91
Jeff Sharkey [Fri, 2 Dec 2016 19:27:23 +0000 (19:27 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am:
6b89229d14 am:
a7efe16fe1 -s ours am:
f1085f2dc8 am:
c130d7fd5e
am:
948841362a
Change-Id: I66fdc5fb2ca169453b6b2f5dc7d6c10360aea709
Jeff Sharkey [Fri, 2 Dec 2016 19:26:28 +0000 (19:26 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
91add43ae7 am:
792d49dfb5 -s ours am:
32af84320b am:
8b5fa0c0c0
am:
d081cb0ab7
Change-Id: I3fc3458a9050e1ee9cb57b9348d67ccd3ce71037
Jeff Sharkey [Fri, 2 Dec 2016 19:13:31 +0000 (19:13 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours am:
ce477912a2 am:
920b02a94f -s ours am:
aff9286bd6
am:
37ff2d56bf
Change-Id: I0ff63a0da9300799a8df538fcefaf0d27ea2be00
Jeff Sharkey [Fri, 2 Dec 2016 19:12:33 +0000 (19:12 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours am:
9277cce7fa am:
a1d1ecbe05 -s ours am:
928c09cd8e
am:
5267b63325
Change-Id: I3cab573840604be9c44e85998c4b1a579d07aee4
Jeff Sharkey [Fri, 2 Dec 2016 19:11:29 +0000 (19:11 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am:
6b89229d14 am:
a7efe16fe1 -s ours am:
f1085f2dc8
am:
c130d7fd5e
Change-Id: I15e9c5f864ec67c8bf5901fcc46abe0c7b362a6e
Jeff Sharkey [Fri, 2 Dec 2016 19:10:35 +0000 (19:10 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
91add43ae7 am:
792d49dfb5 -s ours am:
32af84320b
am:
8b5fa0c0c0
Change-Id: Ie5bb120bcd900c2032e47f0ae3e1c710c083ae2e
Jeff Sharkey [Fri, 2 Dec 2016 19:03:40 +0000 (19:03 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am:
8e14278209 am:
a80cbeeee2 am:
44e8914f8b
am:
26f78f5836 -s ours
Change-Id: I6521af4ca816ed3b03e6954159276971a55d349c
Jeff Sharkey [Fri, 2 Dec 2016 19:02:42 +0000 (19:02 +0000)]
DO NOT MERGE: Check provider access for content changes. am:
4ddbf942a0 am:
190e20c2b5 am:
74b36307a0
am:
4ad177829a -s ours
Change-Id: I946f7bab2f86d26c23460cc5664d901f4f8fff06
Jeff Sharkey [Fri, 2 Dec 2016 18:56:56 +0000 (18:56 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours am:
ce477912a2 am:
920b02a94f -s ours
am:
aff9286bd6
Change-Id: I4f117247986cfa72156d26af917ba1bae6e9fa9b
Jeff Sharkey [Fri, 2 Dec 2016 18:56:01 +0000 (18:56 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours am:
9277cce7fa am:
a1d1ecbe05 -s ours
am:
928c09cd8e
Change-Id: Ic470197dcc815e7ecf6b47dfd74ff6f4f74f1804
Jeff Sharkey [Fri, 2 Dec 2016 18:55:07 +0000 (18:55 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am:
6b89229d14 am:
a7efe16fe1 -s ours
am:
f1085f2dc8
Change-Id: I565994dc5bbfc11b3293cb77aabca77b908a9039
Jeff Sharkey [Fri, 2 Dec 2016 18:54:57 +0000 (18:54 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am:
8e14278209 am:
a80cbeeee2
am:
44e8914f8b
Change-Id: I81d83d40d322bd6cfa2a6b74286cdfa425a2f951
Jeff Sharkey [Fri, 2 Dec 2016 18:53:58 +0000 (18:53 +0000)]
DO NOT MERGE: Check provider access for content changes. am:
4ddbf942a0 am:
190e20c2b5
am:
74b36307a0
Change-Id: I6e5a7fbc4dfe0f207f6787ef5fbba93b0296e1b1
Jeff Sharkey [Fri, 2 Dec 2016 18:53:57 +0000 (18:53 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
91add43ae7 am:
792d49dfb5 -s ours
am:
32af84320b
Change-Id: I73fe93944c2c2aebca02ca85d441905c2075bc65
Jeff Sharkey [Fri, 2 Dec 2016 18:47:08 +0000 (18:47 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev am:
48f6bdfce4 am:
471812ad04
am:
4610805746 -s ours
Change-Id: If9504039b5ec449edb2fb1e9f429a3d568a2aabf
Jeff Sharkey [Fri, 2 Dec 2016 18:45:38 +0000 (18:45 +0000)]
DO NOT MERGE: Check provider access for content changes. am:
ff2fede0dd am:
7340749c2a
am:
a07bcbcc27 -s ours
Change-Id: I9d320f3e2c77712757c17f1609c62c325cca9082
Jeff Sharkey [Fri, 2 Dec 2016 18:40:25 +0000 (18:40 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours am:
ce477912a2
am:
920b02a94f -s ours
Change-Id: I3c2b9ba49785b40df3960fac4ffb17204cab063a
Jeff Sharkey [Fri, 2 Dec 2016 18:39:20 +0000 (18:39 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours am:
9277cce7fa
am:
a1d1ecbe05 -s ours
Change-Id: I6d4f8a29537e19545bf94a886aecea8ba05a6de7
Jeff Sharkey [Fri, 2 Dec 2016 18:38:01 +0000 (18:38 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am:
6b89229d14
am:
a7efe16fe1 -s ours
Change-Id: I17b84f1e8d8432292568c0adb2b3d89563a72b50
Jeff Sharkey [Fri, 2 Dec 2016 18:37:58 +0000 (18:37 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev am:
48f6bdfce4
am:
471812ad04
Change-Id: Ida67c1a00ac95109c647eb182af7628544bbb739
Jeff Sharkey [Fri, 2 Dec 2016 18:37:57 +0000 (18:37 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am:
8e14278209
am:
a80cbeeee2
Change-Id: I6b67d2f65208559d9cb5cd79bfec5fbc506abcad
Jeff Sharkey [Fri, 2 Dec 2016 18:36:40 +0000 (18:36 +0000)]
DO NOT MERGE: Check provider access for content changes. am:
ff2fede0dd
am:
7340749c2a
Change-Id: Iabb21a28a245d36f2247eaace573bdfd134f382d
Jeff Sharkey [Fri, 2 Dec 2016 18:36:38 +0000 (18:36 +0000)]
DO NOT MERGE: Check provider access for content changes. am:
4ddbf942a0
am:
190e20c2b5
Change-Id: Ib8d8b2b97b03acdd56e2cbdada404fb25535d234
Jeff Sharkey [Fri, 2 Dec 2016 18:36:33 +0000 (18:36 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
91add43ae7
am:
792d49dfb5 -s ours
Change-Id: I50ab47cb03b65cc8be78c9a139561e4befbb1a95
Jeff Sharkey [Fri, 2 Dec 2016 18:30:18 +0000 (18:30 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am:
ae7d4b1339 -s ours
am:
ce477912a2
Change-Id: I1f05c5204e6ba49a95a8b21cb457b04fe6738cb0
Jeff Sharkey [Fri, 2 Dec 2016 18:29:19 +0000 (18:29 +0000)]
DO NOT MERGE. Check provider access for content changes. am:
9b85862620 -s ours
am:
9277cce7fa
Change-Id: I5cdc35759ad40566c02db6ee725c199ae255b5b8
Jeff Sharkey [Fri, 2 Dec 2016 18:20:10 +0000 (18:20 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dr1.5-dev
am:
0be332852e -s ours
Change-Id: Ia1266b2276eb2219fbd19aff20985d278bd58fac