OSDN Git Service

android-x86/frameworks-base.git
7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d...
Charles He [Thu, 29 Dec 2016 10:55:23 +0000 (10:55 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d am: 133ff4d611 am: 00a581f882 am: e5156ec1e9 am: 9a47fa7fc0 am: 8bcdab7e6f
am: dd7837c5ad

Change-Id: I2124f52b38314199950d1448cddd2bbd328c85ce

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d...
Charles He [Thu, 29 Dec 2016 10:41:25 +0000 (10:41 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d am: 133ff4d611 am: 00a581f882 am: e5156ec1e9 am: 9a47fa7fc0
am: 8bcdab7e6f

Change-Id: I6e41bfad4ce66ca80bca636a5fb4ddc85b71e83a

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d...
Charles He [Thu, 29 Dec 2016 10:34:04 +0000 (10:34 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d am: 133ff4d611 am: 00a581f882 am: e5156ec1e9
am: 9a47fa7fc0

Change-Id: Ifb9f5b177f7c031352e6e9cf308e6295f7c60074

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d...
Charles He [Thu, 29 Dec 2016 10:25:50 +0000 (10:25 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d am: 133ff4d611 am: 00a581f882
am: e5156ec1e9

Change-Id: I62b79fe7ef5a2febce27729f4709a599832cb3da

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d...
Charles He [Thu, 29 Dec 2016 10:18:49 +0000 (10:18 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d am: 133ff4d611
am: 00a581f882

Change-Id: I016955744e48d7a91380c2ff39f7c64536a39c7e

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d
Charles He [Thu, 29 Dec 2016 10:11:20 +0000 (10:11 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca am: 2ce5c4320d
am: 133ff4d611

Change-Id: I54b163f645f561243aac3df1a55c1023531997b3

7 years agoPrevent writing to FRP partition during factory reset. am: a9437bd1ca
Charles He [Thu, 29 Dec 2016 10:03:53 +0000 (10:03 +0000)]
Prevent writing to FRP partition during factory reset. am: a9437bd1ca
am: 2ce5c4320d

Change-Id: I29339a634fd22cd46bfc08619464da8fe159a2b7

7 years agoPrevent writing to FRP partition during factory reset.
Charles He [Thu, 29 Dec 2016 09:48:45 +0000 (09:48 +0000)]
Prevent writing to FRP partition during factory reset.
am: a9437bd1ca

Change-Id: Ib0b8db2357317dc3e680910c08f15f098baf2af9

7 years agoMerge "[DAC FIXIT]: Noted that UNINSTALL_SHORTCUT is no longer supported." into nyc...
Andrew Solovay [Wed, 28 Dec 2016 20:16:26 +0000 (20:16 +0000)]
Merge "[DAC FIXIT]: Noted that UNINSTALL_SHORTCUT is no longer supported." into nyc-mr1-dev

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:59:47 +0000 (17:59 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66 am: d82f8a67fc am: 1ac8affd51 am: 56098f81b6 am: 7cec76de0f
am: 2da05d0f9e

Change-Id: I8c94a06f5fa722312436484609bafcb0585d6d18

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:54:44 +0000 (17:54 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66 am: d82f8a67fc am: 1ac8affd51 am: 56098f81b6
am: 7cec76de0f

Change-Id: I9168d45717c26e71bb356dd7304276e23c519bd9

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:44:46 +0000 (17:44 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66 am: d82f8a67fc am: 1ac8affd51
am: 56098f81b6

Change-Id: I14fcacaede569580c8ca8e5bbbebb408ddcce76a

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:39:18 +0000 (17:39 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66 am: d82f8a67fc
am: 1ac8affd51

Change-Id: I965c900e266a9189c595612cef6ddac839498949

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:34:11 +0000 (17:34 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66
am: d82f8a67fc

Change-Id: I25e43680e464c5169e8a5b9e8151b0dab2d2cf86

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:29:05 +0000 (17:29 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2
am: 1f458fdc66

Change-Id: I61d4b25ee0264397693f30e2091997c058d0c5fc

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:23:39 +0000 (17:23 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344
am: d28eef0cc2

Change-Id: If937d91cee2bb06406cf3cd1ae6ac3402a51e88d

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:19:10 +0000 (17:19 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b
am: 1684e5f344

Change-Id: I0ebd2856e2e2f3793273ba952b44dc77e85b021e

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:14:05 +0000 (17:14 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516
am: 0a8978f04b

Change-Id: I693665a57465ec57f946fad57cda9ce48389408f

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e am...
Tom O'Neill [Thu, 22 Dec 2016 17:09:09 +0000 (17:09 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872
am: 3380a77516

Change-Id: Ice61f337e1fcfd0569431538e475d94f9d205423

7 years agoFix exploit where can hide the fact that a location was mocked am: a206a0f17e
Tom O'Neill [Thu, 22 Dec 2016 17:04:07 +0000 (17:04 +0000)]
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e
am: d417e54872

Change-Id: I2f47020055f962b36f095137d75c9cbfe6b1a6db

7 years agoFix exploit where can hide the fact that a location was mocked
Tom O'Neill [Thu, 22 Dec 2016 16:58:33 +0000 (16:58 +0000)]
Fix exploit where can hide the fact that a location was mocked
am: a206a0f17e

Change-Id: Ib3af056919a4b909d3d11dd3fe2b46eaa7cdf0f4

7 years agoMerge "docs: remove implicit intent from bindService and startService" into nyc-mr1-dev
Mark Lu [Mon, 19 Dec 2016 20:13:15 +0000 (20:13 +0000)]
Merge "docs: remove implicit intent from bindService and startService" into nyc-mr1-dev

7 years agodocs: remove implicit intent from bindService and startService
Mark Lu [Wed, 14 Dec 2016 00:29:51 +0000 (16:29 -0800)]
docs: remove implicit intent from bindService and startService

bug: 18295867
Change-Id: Ib4b561dd215f4b124ce9a90b446bc03676f7e00a

7 years agodocs: update Paint.setTextSize() to indicate pixel units
Mark Lu [Fri, 16 Dec 2016 22:23:47 +0000 (14:23 -0800)]
docs: update Paint.setTextSize() to indicate pixel units

bug: 2321154
Change-Id: Ic71404677a8079c744b99d4848d69c6ff52089ab

7 years agodocs: Add deprecation message for the developer.android.com docs am: b9bd6cca9e
Joe Fernandez [Sat, 17 Dec 2016 04:37:05 +0000 (04:37 +0000)]
docs: Add deprecation message for the developer.android.com docs am: b9bd6cca9e
am: 045ae0458a

Change-Id: I2257467a9b263897d2af594720de61d29a982709

7 years agodocs: Add deprecation message for the developer.android.com docs
Joe Fernandez [Sat, 17 Dec 2016 04:26:02 +0000 (04:26 +0000)]
docs: Add deprecation message for the developer.android.com docs
am: b9bd6cca9e

Change-Id: I3ba7d4519c491bdf09836f096106b4a6bc52e116

7 years ago[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file am: c3db570a00...
Svet Ganov [Sat, 17 Dec 2016 03:32:01 +0000 (03:32 +0000)]
[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file am: c3db570a00  -s ours
am: c91845f753

Change-Id: Ia85d2855dd8360b94fecb4bf6cd280ea4518d0e1

7 years ago[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file
Svet Ganov [Sat, 17 Dec 2016 03:21:28 +0000 (03:21 +0000)]
[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file
am: c3db570a00  -s ours

Change-Id: I63b03cd2b057f95aefab23cdb4a29766ec304544

7 years agodocs: Add deprecation message for the developer.android.com docs
Joe Fernandez [Sat, 17 Dec 2016 02:20:56 +0000 (18:20 -0800)]
docs: Add deprecation message for the developer.android.com docs

Change-Id: Ia091df49099482696abbc3a596cf1787ca904d67

7 years agoMerge "docs: update description for BitmapFactory.Options#inBitmap" into nyc-mr1-dev
Mark Lu [Sat, 17 Dec 2016 02:04:23 +0000 (02:04 +0000)]
Merge "docs: update description for BitmapFactory.Options#inBitmap" into nyc-mr1-dev

7 years agodocs: update description for BitmapFactory.Options#inBitmap
Mark Lu [Fri, 16 Dec 2016 23:43:27 +0000 (15:43 -0800)]
docs: update description for BitmapFactory.Options#inBitmap

bug: 18730109
Change-Id: Iab062d41af3a32208d3500179d3737278a035188

7 years agoMerge "docs: changes to broadcast documentation" into nyc-mr1-dev
Mark Lu [Fri, 16 Dec 2016 04:48:36 +0000 (04:48 +0000)]
Merge "docs: changes to broadcast documentation" into nyc-mr1-dev

7 years ago[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file
Svet Ganov [Thu, 15 Dec 2016 22:51:17 +0000 (14:51 -0800)]
[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file

bug:33039926
bug:33042690

Change-Id: If0431b77ec546c72f8cc25bb605a851572bb22a6

7 years agoFix exploit where can hide the fact that a location was mocked
Tom O'Neill [Thu, 15 Dec 2016 18:26:28 +0000 (10:26 -0800)]
Fix exploit where can hide the fact that a location was mocked

- Even if call setTestProviderLocation() with inconsistent providers,
should still end up with a location that is flagged as mocked

- Bug: 33091107

Change-Id: I39e038f25b975989c2e8651bfd9ec9e74073e6cd

7 years agofix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec ...
Julius D'souza [Wed, 14 Dec 2016 19:11:59 +0000 (19:11 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec  -s ours am: 7a69e8f3d8 am: af0b547fc7
am: 20081c4e71

Change-Id: I5e461a835cf64ba69894da2c5493a9d8a1ebcbcf

7 years agofix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec ...
Julius D'souza [Wed, 14 Dec 2016 19:06:29 +0000 (19:06 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec  -s ours am: 7a69e8f3d8
am: af0b547fc7

Change-Id: I23ef765ebbd2dde2110946fcc46c6b61e11733f2

7 years agofix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec ...
Julius D'souza [Wed, 14 Dec 2016 19:00:38 +0000 (19:00 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController am: e6f8cb29ec  -s ours
am: 7a69e8f3d8

Change-Id: I581e1cd6ef0dec7042802b29dd76db8ffc02cec3

7 years agofix case issues with mGoingIdleWakeLock in DeviceIdleController
Julius D'souza [Wed, 14 Dec 2016 18:54:02 +0000 (18:54 +0000)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController
am: e6f8cb29ec  -s ours

Change-Id: Ia7bdba0fd3d52bb2d7c33f81d376336563f3a5cb

7 years agofix case issues with mGoingIdleWakeLock in DeviceIdleController
Julius D'souza [Wed, 14 Dec 2016 18:30:25 +0000 (10:30 -0800)]
fix case issues with mGoingIdleWakeLock in DeviceIdleController

Bug: 31900521

Change-Id: I9484b10f0e6b99dfaf11266bb275a31d7ff3868c

7 years agoDO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle...
Julius D'souza [Wed, 14 Dec 2016 18:03:26 +0000 (18:03 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle. am: f9f39cc4a8  -s ours am: 589f83e686  -s ours am: 495aa09cc6  -s ours
am: 10a9005003  -s ours

Change-Id: I7a1d2d5b60b27765b2381e6d85fd3f8e967a40e1

7 years agoDO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle...
Julius D'souza [Wed, 14 Dec 2016 17:56:53 +0000 (17:56 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle. am: f9f39cc4a8  -s ours am: 589f83e686  -s ours
am: 495aa09cc6  -s ours

Change-Id: I0f1a50fac9a6fc8a5c21b890aaa3aea5ea2aca74

7 years agoDO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle...
Julius D'souza [Wed, 14 Dec 2016 17:51:28 +0000 (17:51 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle. am: f9f39cc4a8  -s ours
am: 589f83e686  -s ours

Change-Id: I76a619ed9824174735d0a86c55fe13a3d6e90ec5

7 years agoDO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle.
Julius D'souza [Wed, 14 Dec 2016 17:44:27 +0000 (17:44 +0000)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController is going idle.
am: f9f39cc4a8  -s ours

Change-Id: Ibd0b18a9e833afcc85845f4db57a927e80739cc2

7 years agoPrevent writing to FRP partition during factory reset.
Charles He [Thu, 24 Nov 2016 14:05:00 +0000 (14:05 +0000)]
Prevent writing to FRP partition during factory reset.

Avoid potential race condition between FRP wipe and write operations
during factory reset by making the FRP partition unwritable after
wipe.

Bug: 30352311
Test: manual
Change-Id: If3f024a1611366c0677a996705724458094fcfad
(cherry picked from commit a629c772f4a7a5ddf7ff9f78fb19f7ab86c2a9c2)

7 years agodocs: changes to broadcast documentation
Mark Lu [Mon, 5 Dec 2016 18:57:55 +0000 (10:57 -0800)]
docs: changes to broadcast documentation

- move BroadcastReceiver info to developer guide. see cl/140402421
- add usage note to CONNECTIVITY_ACTION broadcast

bug:32533262
bug:33106411

Change-Id: Ic2aa517831d29418e0c42aa6fc1e7f9aeb50f802

7 years agoDO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController
Julius D'souza [Tue, 13 Dec 2016 01:15:17 +0000 (17:15 -0800)]
DO NOT MERGE ANYWHERE: Hold a wake lock while DeviceIdleController
is going idle.

The inputs to DeviceIdleController (alarm manager, sensors)
hold wake locks while they call it.  But then the real work
happens in a handler which is outside of the wakelock, so
listeners don't get a chance to run right away, which in
the case of NetworkPolicyManager means the device is in a
higher power state than it should be.

It's not clear that this will 100% fix the bug, because
NetworkPolicyManagerService also has its own internal
Handler, and isn't holding its own wakelock for this,
but this change allows NPMS to be fixed if it really
needed to be.

Bug: 31900521
Change-Id: I706045aa189147824c9214c57abc13993aee9a5b

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Fri, 9 Dec 2016 01:43:52 +0000 (01:43 +0000)]
Fix vulnerability in MemoryIntArray
am: 1181f448c1

Change-Id: I4217066be49bb9525e945f110c22eb864ec6c212

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 23:58:02 +0000 (23:58 +0000)]
Fix vulnerability in MemoryIntArray

MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.

Tests: Updated the tests and they pass.

bug:33039926
bug:33042690

Change-Id: Ibf56827209a9b791aa83ae679219baf829ffc2ac

7 years agoRevert "Fix vulnerability in MemoryIntArray am: a97171ec49"
Bill Napier [Thu, 8 Dec 2016 22:30:02 +0000 (22:30 +0000)]
Revert "Fix vulnerability in MemoryIntArray am: a97171ec49"
am: 43966dafb3

Change-Id: I01bc83edd411dc39cb696e64ea35b5d4a8497fbf

7 years agoRevert "Fix vulnerability in MemoryIntArray am: a97171ec49"
Bill Napier [Thu, 8 Dec 2016 22:22:38 +0000 (22:22 +0000)]
Revert "Fix vulnerability in MemoryIntArray am: a97171ec49"

This reverts commit fb12dd509f8e106d034f67c2e404845128128994.

Change-Id: I9e1b22b8df0e754095541a758096cba279a81ab1

7 years agoFix vulnerability in MemoryIntArray am: a97171ec49
Svetoslav Ganov [Thu, 8 Dec 2016 21:42:05 +0000 (21:42 +0000)]
Fix vulnerability in MemoryIntArray am: a97171ec49
am: fb12dd509f

Change-Id: I269ec7d61ebdc9f485d759d1398d5fa4eacf868f

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 21:37:33 +0000 (21:37 +0000)]
Fix vulnerability in MemoryIntArray
am: a97171ec49

Change-Id: Ifa2221a9b8ca705ef0239d61772938ac11761ce2

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 19:48:19 +0000 (11:48 -0800)]
Fix vulnerability in MemoryIntArray

MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

 Further, we now check the memory mapped size against
 the size of the underlying ashmem region after we do
 the memory mapping (to fix the ahsmem size) and if
 an attacker changed the size under us we throw.

 Tests: Updated the tests and they pass.

 bug:33039926
 bug:33042690

Change-Id: I1004579181ff7a223ef659e85c46100c47ab2409

7 years agoRevert "Fix vulnerability in MemoryIntArray" am: 1f06508bc6
Svetoslav Ganov [Thu, 8 Dec 2016 02:33:00 +0000 (02:33 +0000)]
Revert "Fix vulnerability in MemoryIntArray" am: 1f06508bc6
am: 64b5725900

Change-Id: Id7021fb02059cfb3bb9184ef24f417c0be7f55b9

7 years agoRevert "Fix vulnerability in MemoryIntArray"
Svetoslav Ganov [Thu, 8 Dec 2016 02:29:00 +0000 (02:29 +0000)]
Revert "Fix vulnerability in MemoryIntArray"
am: 1f06508bc6

Change-Id: Id387817495b1857f304203c8487da3db49bdd0e4

7 years agoRevert "Fix vulnerability in MemoryIntArray"
Svetoslav Ganov [Thu, 8 Dec 2016 02:17:40 +0000 (02:17 +0000)]
Revert "Fix vulnerability in MemoryIntArray"

This reverts commit 4694cad51122c20880d00389ef95833d7a14b358.

Change-Id: I235ea3c4bd86d90bf97bc1a2d023f4780251e570

7 years agoFix vulnerability in MemoryIntArray am: 4694cad511
Svetoslav Ganov [Thu, 8 Dec 2016 01:56:24 +0000 (01:56 +0000)]
Fix vulnerability in MemoryIntArray am: 4694cad511
am: ec40a70ffb

Change-Id: I5d03aaa04fe13b3af20bcc61e9bb925b471ab825

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 01:49:21 +0000 (01:49 +0000)]
Fix vulnerability in MemoryIntArray
am: 4694cad511

Change-Id: I64257a851c06e4a333056ee132ff8a2ea29aef5c

7 years agoRevert "Fix vulnerability in MemoryIntArray" am: 29139a8ae5
Aart Bik [Thu, 8 Dec 2016 01:44:54 +0000 (01:44 +0000)]
Revert "Fix vulnerability in MemoryIntArray" am: 29139a8ae5
am: 86699f980f

Change-Id: I7876874ba0d6815920f21021a47e3fe1b3e1c42f

7 years agoRevert "Fix vulnerability in MemoryIntArray"
Aart Bik [Thu, 8 Dec 2016 01:36:50 +0000 (01:36 +0000)]
Revert "Fix vulnerability in MemoryIntArray"
am: 29139a8ae5

Change-Id: I3975cfc51bd03a65855c113dfdb827d24471e0ba

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 01:30:38 +0000 (01:30 +0000)]
Fix vulnerability in MemoryIntArray

MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.

Tests: Updated the tests and they pass.

bug:33039926
bug:33042690

Change-Id: Id7f0e8a4c861b0b9fa796767e0c22d96633b14d1

7 years agoRevert "Fix vulnerability in MemoryIntArray"
Aart Bik [Thu, 8 Dec 2016 01:05:35 +0000 (01:05 +0000)]
Revert "Fix vulnerability in MemoryIntArray"

This reverts commit 86dfa094de773670743d41c3e3156eace8e403a3.

BROKE BUILD (as shown in some treehugger builds)

frameworks/base/core/java/android/util/MemoryIntArray.java:84: error: cannot find symbol
        mCloseGuard.open("close");
        ^

bug:33039926
bug:33042690

Change-Id: Ief875e543ec849fe55c747fb1ed5253f0cd9a122

7 years agoFix vulnerability in MemoryIntArray am: 86dfa094de
Svetoslav Ganov [Thu, 8 Dec 2016 00:49:48 +0000 (00:49 +0000)]
Fix vulnerability in MemoryIntArray am: 86dfa094de
am: 367023218e

Change-Id: I38d3f7089b9678210772f79215b44198b262e922

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Thu, 8 Dec 2016 00:42:18 +0000 (00:42 +0000)]
Fix vulnerability in MemoryIntArray
am: 86dfa094de

Change-Id: I664782bea6e2b941ba94e51c65afd7e9b0f95f8d

7 years agoFix vulnerability in MemoryIntArray
Svetoslav Ganov [Wed, 7 Dec 2016 23:19:09 +0000 (15:19 -0800)]
Fix vulnerability in MemoryIntArray

MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

Further, we now check the memory mapped size against
the size of the underlying ashmem region after we do
the memory mapping (to fix the ahsmem size) and if
an attacker changed the size under us we throw.

Tests: Updated the tests and they pass.

bug:33039926
bug:33042690

Change-Id: Ie267646eb88014034fbd048d7a9bc273420c7eff

7 years agoMerge "Change insecure HTTP resource link to scheme-relative link." into nyc-mr1-dev
Elliot Waite [Tue, 6 Dec 2016 01:52:08 +0000 (01:52 +0000)]
Merge "Change insecure HTTP resource link to scheme-relative link." into nyc-mr1-dev

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 20:11:33 +0000 (20:11 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours am: aff9286bd6 am: 37ff2d56bf am: 56247334f8 am: 923aef8e02  -s ours am: f199d511c3
am: 1d752340a7

Change-Id: Ie7b1d07a622a9b5be4e0d5d9b08b33b821b8e43a

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 20:10:37 +0000 (20:10 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours am: 928c09cd8e am: 5267b63325 am: a51ebb828a am: acfda3d71a  -s ours am: 0eaa192436
am: 43b3a13803

Change-Id: I5f4f250100c3b9f63149add16f0086c77ccdf7ca

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 20:09:34 +0000 (20:09 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours am: f1085f2dc8 am: c130d7fd5e am: 948841362a am: 7e54dc58d4  -s ours am: 3fa188bd8f
am: 09960bdfcc

Change-Id: Ib66ff9a9e82f9ed3e7e291c0bcca1be9d4f38805

7 years agoDO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb...
Jeff Sharkey [Fri, 2 Dec 2016 20:08:37 +0000 (20:08 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb5  -s ours am: 32af84320b am: 8b5fa0c0c0 am: d081cb0ab7 am: cd35e746dc  -s ours am: 836b54e6bb
am: 383e0cfa06

Change-Id: I231c3a499177db213b0406ea84e7ea3c224f132d

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:55:09 +0000 (19:55 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours am: aff9286bd6 am: 37ff2d56bf am: 56247334f8 am: 923aef8e02  -s ours
am: f199d511c3

Change-Id: I990a5459cd64bbc0e2ede2d3b5899163d12818f4

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 19:54:12 +0000 (19:54 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours am: 928c09cd8e am: 5267b63325 am: a51ebb828a am: acfda3d71a  -s ours
am: 0eaa192436

Change-Id: Ie0fe9fd6770c94d56b3af10902c44c52d9a2f2a3

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:53:09 +0000 (19:53 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours am: f1085f2dc8 am: c130d7fd5e am: 948841362a am: 7e54dc58d4  -s ours
am: 3fa188bd8f

Change-Id: Ibae31cd6439c2fdfcc9d333ca23bd466a7730218

7 years agoDO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb...
Jeff Sharkey [Fri, 2 Dec 2016 19:52:04 +0000 (19:52 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb5  -s ours am: 32af84320b am: 8b5fa0c0c0 am: d081cb0ab7 am: cd35e746dc  -s ours
am: 836b54e6bb

Change-Id: Ib546b18b5373aaf8e429a3e8668a23a9d3b5c411

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:46:36 +0000 (19:46 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours am: aff9286bd6 am: 37ff2d56bf am: 56247334f8
am: 923aef8e02  -s ours

Change-Id: Ia0d0ac5ed1f8a84bd9158530fde499f91ac7f411

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 19:45:33 +0000 (19:45 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours am: 928c09cd8e am: 5267b63325 am: a51ebb828a
am: acfda3d71a  -s ours

Change-Id: I0857c3cdd2e471ad04dbafc22a7898168a615a24

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:44:38 +0000 (19:44 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours am: f1085f2dc8 am: c130d7fd5e am: 948841362a
am: 7e54dc58d4  -s ours

Change-Id: I3dce2baad70e1d9d606c27534f4ff4e9435f2445

7 years agoDO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb...
Jeff Sharkey [Fri, 2 Dec 2016 19:43:33 +0000 (19:43 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb5  -s ours am: 32af84320b am: 8b5fa0c0c0 am: d081cb0ab7
am: cd35e746dc  -s ours

Change-Id: I12608bbd9173dc053df967174bc59f9297a151c2

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:29:15 +0000 (19:29 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours am: aff9286bd6 am: 37ff2d56bf
am: 56247334f8

Change-Id: I8bf5769fbb68fb10a4acd2c557dc1c66a3c448df

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 19:28:18 +0000 (19:28 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours am: 928c09cd8e am: 5267b63325
am: a51ebb828a

Change-Id: Ic67fac2e28ab776632a98e3556c46826d7335a91

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:27:23 +0000 (19:27 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours am: f1085f2dc8 am: c130d7fd5e
am: 948841362a

Change-Id: I66fdc5fb2ca169453b6b2f5dc7d6c10360aea709

7 years agoDO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb...
Jeff Sharkey [Fri, 2 Dec 2016 19:26:28 +0000 (19:26 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb5  -s ours am: 32af84320b am: 8b5fa0c0c0
am: d081cb0ab7

Change-Id: I3fc3458a9050e1ee9cb57b9348d67ccd3ce71037

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:21:21 +0000 (19:21 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am: 8e14278209 am: a80cbeeee2 am: 44e8914f8b am: 26f78f5836  -s ours am: 99b97e5ed1
am: 398cdb6929

Change-Id: I40a0cb7f416d843b12893656d16dfed97d0df058

7 years agoDO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b...
Jeff Sharkey [Fri, 2 Dec 2016 19:20:23 +0000 (19:20 +0000)]
DO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b5 am: 74b36307a0 am: 4ad177829a  -s ours am: c067e76bba
am: 0891ca2fad

Change-Id: I2e9897c052ee296d68beb50b6ac927e5a0d92daa

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:19:29 +0000 (19:19 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev am: 48f6bdfce4 am: 471812ad04 am: 4610805746  -s ours am: aeeb9c8470
am: 8c74832d5e

Change-Id: I35d8c2faba5a6f359bbe51b56052bafe90a6cac1

7 years agoDO NOT MERGE: Check provider access for content changes. am: ff2fede0dd am: 7340749c2...
Jeff Sharkey [Fri, 2 Dec 2016 19:18:31 +0000 (19:18 +0000)]
DO NOT MERGE: Check provider access for content changes. am: ff2fede0dd am: 7340749c2a am: a07bcbcc27  -s ours am: e0fe3201cb
am: 8165a22f53

Change-Id: Iee87f3c3d384bf785b3c6c877a817c35bbdb478b

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:13:31 +0000 (19:13 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours am: aff9286bd6
am: 37ff2d56bf

Change-Id: I0ff63a0da9300799a8df538fcefaf0d27ea2be00

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 19:12:33 +0000 (19:12 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours am: 928c09cd8e
am: 5267b63325

Change-Id: I3cab573840604be9c44e85998c4b1a579d07aee4

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:12:00 +0000 (19:12 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am: 8e14278209 am: a80cbeeee2 am: 44e8914f8b am: 26f78f5836  -s ours
am: 99b97e5ed1

Change-Id: I1812de0dd036142fae97145361fdf5da50e61536

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:11:29 +0000 (19:11 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours am: f1085f2dc8
am: c130d7fd5e

Change-Id: I15e9c5f864ec67c8bf5901fcc46abe0c7b362a6e

7 years agoDO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b...
Jeff Sharkey [Fri, 2 Dec 2016 19:10:36 +0000 (19:10 +0000)]
DO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b5 am: 74b36307a0 am: 4ad177829a  -s ours
am: c067e76bba

Change-Id: I36e17906c43408126d1acabde89bf7ec04e16aab

7 years agoDO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb...
Jeff Sharkey [Fri, 2 Dec 2016 19:10:35 +0000 (19:10 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 91add43ae7 am: 792d49dfb5  -s ours am: 32af84320b
am: 8b5fa0c0c0

Change-Id: Ie5bb120bcd900c2032e47f0ae3e1c710c083ae2e

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 19:03:40 +0000 (19:03 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am: 8e14278209 am: a80cbeeee2 am: 44e8914f8b
am: 26f78f5836  -s ours

Change-Id: I6521af4ca816ed3b03e6954159276971a55d349c

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev...
Jeff Sharkey [Fri, 2 Dec 2016 19:03:36 +0000 (19:03 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dr-dev am: 48f6bdfce4 am: 471812ad04 am: 4610805746  -s ours
am: aeeb9c8470

Change-Id: I886018e68c75bb833d0a18c76f6db557b1b9c9e8

7 years agoDO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b...
Jeff Sharkey [Fri, 2 Dec 2016 19:02:42 +0000 (19:02 +0000)]
DO NOT MERGE: Check provider access for content changes. am: 4ddbf942a0 am: 190e20c2b5 am: 74b36307a0
am: 4ad177829a  -s ours

Change-Id: I946f7bab2f86d26c23460cc5664d901f4f8fff06

7 years agoDO NOT MERGE: Check provider access for content changes. am: ff2fede0dd am: 7340749c2...
Jeff Sharkey [Fri, 2 Dec 2016 19:02:36 +0000 (19:02 +0000)]
DO NOT MERGE: Check provider access for content changes. am: ff2fede0dd am: 7340749c2a am: a07bcbcc27  -s ours
am: e0fe3201cb

Change-Id: Ifbfd912aac170923e5aea43e3b5ba9cfe135cea5

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 18:56:56 +0000 (18:56 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-dev am: ae7d4b1339  -s ours am: ce477912a2 am: 920b02a94f  -s ours
am: aff9286bd6

Change-Id: I4f117247986cfa72156d26af917ba1bae6e9fa9b

7 years agoDO NOT MERGE. Check provider access for content changes. am: 9b85862620 -s ours...
Jeff Sharkey [Fri, 2 Dec 2016 18:56:01 +0000 (18:56 +0000)]
DO NOT MERGE. Check provider access for content changes. am: 9b85862620  -s ours am: 9277cce7fa am: a1d1ecbe05  -s ours
am: 928c09cd8e

Change-Id: Ic470197dcc815e7ecf6b47dfd74ff6f4f74f1804

7 years agoMerge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev...
Jeff Sharkey [Fri, 2 Dec 2016 18:55:07 +0000 (18:55 +0000)]
Merge "DO NOT MERGE. Check provider access for content changes." into lmp-mr1-dev am: 6b89229d14 am: a7efe16fe1  -s ours
am: f1085f2dc8

Change-Id: I565994dc5bbfc11b3293cb77aabca77b908a9039

7 years agoMerge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am...
Jeff Sharkey [Fri, 2 Dec 2016 18:54:57 +0000 (18:54 +0000)]
Merge "DO NOT MERGE: Check provider access for content changes." into mnc-dev am: 8e14278209 am: a80cbeeee2
am: 44e8914f8b

Change-Id: I81d83d40d322bd6cfa2a6b74286cdfa425a2f951