Snap for 5401728 from c7c5db80460b4a6d19371165941cf1caa345bc7c to qt-releaseandroid-vts-10.0_r9android-vts-10.0_r8android-vts-10.0_r7android-vts-10.0_r6android-vts-10.0_r5android-vts-10.0_r4android-vts-10.0_r3android-vts-10.0_r2android-vts-10.0_r16android-vts-10.0_r15android-vts-10.0_r14android-vts-10.0_r13android-vts-10.0_r12android-vts-10.0_r11android-vts-10.0_r10android-vts-10.0_r1android-security-10.0.0_r75android-security-10.0.0_r74android-security-10.0.0_r73android-security-10.0.0_r72android-security-10.0.0_r71android-security-10.0.0_r70android-security-10.0.0_r69android-security-10.0.0_r68android-security-10.0.0_r67android-security-10.0.0_r66android-security-10.0.0_r65android-security-10.0.0_r64android-security-10.0.0_r63android-security-10.0.0_r62android-security-10.0.0_r61android-security-10.0.0_r60android-security-10.0.0_r59android-security-10.0.0_r58android-security-10.0.0_r57android-security-10.0.0_r56android-security-10.0.0_r55android-security-10.0.0_r54android-security-10.0.0_r53android-security-10.0.0_r52android-security-10.0.0_r51android-security-10.0.0_r50android-security-10.0.0_r49android-security-10.0.0_r48android-mainline-10.0.0_r3android-mainline-10.0.0_r2android-mainline-10.0.0_r1android-cts-10.0_r9android-cts-10.0_r8android-cts-10.0_r7android-cts-10.0_r6android-cts-10.0_r5android-cts-10.0_r4android-cts-10.0_r3android-cts-10.0_r2android-cts-10.0_r16android-cts-10.0_r15android-cts-10.0_r14android-cts-10.0_r13android-cts-10.0_r12android-cts-10.0_r11android-cts-10.0_r10android-cts-10.0_r1android-10.0.0_r6android-10.0.0_r5android-10.0.0_r47android-10.0.0_r46android-10.0.0_r4android-10.0.0_r3android-10.0.0_r2android-10.0.0_r17android-10.0.0_r11android-10.0.0_r10android-10.0.0_r1android10-tests-releaseandroid10-security-releaseandroid10-s3-releaseandroid10-s2-releaseandroid10-s1-releaseandroid10-releaseandroid10-mainline-releaseandroid10-mainline-a-releaseandroid10-gsi

Change-Id: I9957a7ca255be73f735f2e4e9ad73467d1a6b96d

2 files changed, 25 insertions, 5 deletions

diff --git a/ServiceManager.cpp b/ServiceManager.cpp
index f76afcd..c274d0e 100644
--- a/ServiceManager.cpp
+++ b/ServiceManager.cpp
@@ -314,7 +314,7 @@ Return<bool> ServiceManager::add(const hidl_string& name, const sp<IBase>& servi
     return addSuccess;
 }
 
-bool ServiceManager::addImpl(const hidl_string& name,
+bool ServiceManager::addImpl(const std::string& name,
                              const sp<IBase>& service,
                              const hidl_vec<hidl_string>& interfaceChain,
                              const AccessControl::CallingContext& callingContext) {
@@ -332,16 +332,36 @@ bool ServiceManager::addImpl(const hidl_string& name,
         }
     }
 
+    // Detect duplicate registration
+    if (interfaceChain.size() > 1) {
+        // second to last entry should be the highest base class other than IBase.
+        const std::string baseFqName = interfaceChain[interfaceChain.size() - 2];
+        const HidlService *hidlService = lookup(baseFqName, name);
+        if (hidlService != nullptr && hidlService->getService() != nullptr) {
+            // This shouldn't occur during normal operation. Here are some cases where
+            // it might get hit:
+            // - bad configuration (service installed on device multiple times)
+            // - race between death notification and a new service being registered
+            //     (previous logs should indicate a separate problem)
+            const std::string childFqName = interfaceChain[0];
+            pid_t newServicePid = IPCThreadState::self()->getCallingPid();
+            pid_t oldServicePid = hidlService->getDebugPid();
+            LOG(WARNING) << "Detected instance of " << childFqName << " (pid: " << newServicePid
+                    << ") registering over instance of or with base of " << baseFqName << " (pid: "
+                    << oldServicePid << ").";
+        }
+    }
+
+    // Unregister superclass if subclass is registered over it
     {
         // For IBar extends IFoo if IFoo/default is being registered, remove
         // IBar/default. This makes sure the following two things are equivalent
         // 1). IBar::castFrom(IFoo::getService(X))
         // 2). IBar::getService(X)
         // assuming that IBar is declared in the device manifest and there
-        // is also not an IBaz extends IFoo.
+        // is also not an IBaz extends IFoo and there is no race.
         const std::string childFqName = interfaceChain[0];
-        const PackageInterfaceMap &ifaceMap = mServiceMap[childFqName];
-        const HidlService *hidlService = ifaceMap.lookup(name);
+        const HidlService *hidlService = lookup(childFqName, name);
         if (hidlService != nullptr) {
             const sp<IBase> remove = hidlService->getService();
 
diff --git a/ServiceManager.h b/ServiceManager.h
index 8f0c83a..e70110c 100644
--- a/ServiceManager.h
+++ b/ServiceManager.h
@@ -88,7 +88,7 @@ struct ServiceManager : public V1_2::IServiceManager, hidl_death_recipient {
 
     virtual void serviceDied(uint64_t cookie, const wp<IBase>& who);
 private:
-    bool addImpl(const hidl_string& name,
+    bool addImpl(const std::string& name,
                  const sp<IBase>& service,
                  const hidl_vec<hidl_string>& interfaceChain,
                  const AccessControl::CallingContext& callingContext);