Age | Commit message (Collapse) | Author |
|
The comments here were wrong. I*::getService only waits for HIDL
services which are declared in the VINTF manifest. This test usually
passed before because testing the passthrough service gave enough
time for the server to start.
Fixes: 206700689
Test: atest libhwbinder_benchmark
Change-Id: Ibaac31fde82d6cbd2c03aac362fd26ba48f9165f
|
|
|
|
The instrumentation PGO pipeline is deprecated and to be replaced
by AFDO.
Test: presubmit
Change-Id: I4b0b869fe194285710baefe500d75254d7e7fbaa
|
|
Test: N/A
Bug: N/A
Change-Id: Ic806d1c9821b94fad7c96a73d8c9995200c3ebcd
|
|
|
|
Tag: #feature
Bug: 206614050
Test: Compiles
Change-Id: If84517466253c9f83b2bc77a4233dea89dc827e0
|
|
-s ours am: 79cfe559b5 -s ours
am skip reason: Merged-In Ia961878214b0f572ff197f23ce4d30bffaddee0e with SHA-1 a6d67b00c8 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1847920
Change-Id: Ib54cb5ccb32a1f810303b514be4fe4050ce1778c
|
|
-s ours
am skip reason: Merged-In Ia961878214b0f572ff197f23ce4d30bffaddee0e with SHA-1 a6d67b00c8 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1847920
Change-Id: I15a27a646cab6202e220cc7c061c8b1f76362648
|
|
am skip reason: Merged-In Ia961878214b0f572ff197f23ce4d30bffaddee0e with SHA-1 a6d67b00c8 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1847920
Change-Id: I7e86a6060926fcef5cf6bf8d491bca05b61e7e68
|
|
Bug: 202323961
Merged-In: Ia961878214b0f572ff197f23ce4d30bffaddee0e
Change-Id: Ia2deab591dbbd1152ec6507b8c8614b4cf124cf7
|
|
37a8ced1b0
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1815086
Change-Id: I57dcd375804d881d9e54e5b24f91b40000491200
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1815086
Change-Id: I0abd8ed82fdc3e2e7a0ca649e1cbfb3c42bc208d
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1815086
Change-Id: Ia961878214b0f572ff197f23ce4d30bffaddee0e
|
|
|
|
missing bounds check
Fixes: 197919958
Test: hidl_test (while manually triggering ubsan)
Change-Id: I0234f56f0649b7bafec6f4e33509a93a3c739221
|
|
system/libhwbinder/Parcel.cpp am: bca47a6466 am: 2cd9e216ce am: 993e0e276b
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1811296
Change-Id: I73c7bbe3b3b3e0ba00aa0be3bfc379eeb118259c
|
|
system/libhwbinder/Parcel.cpp am: bca47a6466 am: 2cd9e216ce
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1811296
Change-Id: Ifac9c44713f7830b937835ce4c569ce6fc65a6c5
|
|
system/libhwbinder/Parcel.cpp am: bca47a6466
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1811296
Change-Id: Ia20f8047e70b0fdb1f609f1ed2e9661483311bfa
|
|
system/libhwbinder/Parcel.cpp
Like change 1806797, we also try to fix the same compling problem in system/libhwbinder/Parcel.cpp when we enable LOG_REFS.
Change-Id: I74d0f6433791135945b4901108560a5c240e764e
Test: manual
|
|
8a37d47288 -s ours am: aca432e79f -s ours
am skip reason: Merged-In I48fb37b9fb8af94825f6e7c3ea05b9620c8e1a7e with SHA-1 df18496cc6 is already in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/15572008
Change-Id: I5fdbffc70a45a1dbd6e63da58d2cb47ca02dd0c2
|
|
8a37d47288 -s ours
am skip reason: Merged-In I48fb37b9fb8af94825f6e7c3ea05b9620c8e1a7e with SHA-1 df18496cc6 is already in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/15572008
Change-Id: I9ef1173600fb036c8b22618521c4c6d5c057b0d6
|
|
Merged-In: I48fb37b9fb8af94825f6e7c3ea05b9620c8e1a7e
Change-Id: Id3c0fdf3aa6bf3111ddfcd0c21cb5c62ae1d8b82
|
|
6e2965420a
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1794949
Change-Id: I477d6f2dbf637b2304d0b00165cbad150cc442b1
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1794949
Change-Id: I2804cd14d03fdbf4b7f25463e8503a737cb7cf05
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1794949
Change-Id: Ia5c353034a1f21ddb15238140a7058b07017bb14
|
|
Can't downgrade this log enough.
Bug: 195968648
Test: N/A
Change-Id: Id784aae0cb8fce0f7efd5e9d153f8401d9b62193
|
|
062365942b -s ours am: 7fe0ed1b66 -s ours
am skip reason: Merged-In I6fc38d4dae7e8ed1eab1510eb6775c42344d0ce5 with SHA-1 1b1e65d670 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1763665
Change-Id: I48fb37b9fb8af94825f6e7c3ea05b9620c8e1a7e
|
|
062365942b -s ours
am skip reason: Merged-In I6fc38d4dae7e8ed1eab1510eb6775c42344d0ce5 with SHA-1 1b1e65d670 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1763665
Change-Id: Ia8bb2b3f63431bfd0beb0fd8d5bcb0da8a9c4fd8
|
|
Merged-In: I6fc38d4dae7e8ed1eab1510eb6775c42344d0ce5
Merged-In: I422190daf26845f8a9625dd798acb922b3673d68
Merged-In: I422190daf26845f8a9625dd798acb922b3673d68
Change-Id: I004a6beb4e89fe107be73ee4913e687dc44e5fa1
|
|
MERGE am: a4ce3dc7b5 -s ours
am skip reason: Merged-In I911a64b80804f1f34415ee1fad44dc27d5d84e00 with SHA-1 841be7a5ff is already in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/15256465
Change-Id: I31c6f6c15fc2c6ecf390aa90ad3c971883d6bd7e
|
|
Merged-In: I422190daf26845f8a9625dd798acb922b3673d68
Merged-In: I911a64b80804f1f34415ee1fad44dc27d5d84e00
Change-Id: Id1a42dc1f9641fca5521929ec52e5e8305d735f6
|
|
am skip reason: Merged-In I5a42028523fe70a9710c4f9da005d2d9c3ba5817 with SHA-1 1dfb3e999b is already in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14721089
Change-Id: I911a64b80804f1f34415ee1fad44dc27d5d84e00
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1718151
Change-Id: I48c2b35d3ae9dfaab85305d04929abd17374d6b9
|
|
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/1718151
Change-Id: I6fc38d4dae7e8ed1eab1510eb6775c42344d0ce5
|
|
We do get this info in dmesg as well. Reduce spam.
Fixes: 188928044
Test: N/A
Change-Id: I5a42028523fe70a9710c4f9da005d2d9c3ba5817
Merged-In: I5a42028523fe70a9710c4f9da005d2d9c3ba5817
|
|
We do get this info in dmesg as well. Reduce spam.
Bug: 188928044
Test: N/A
Change-Id: I5a42028523fe70a9710c4f9da005d2d9c3ba5817
|
|
14651881, 14651915, 14651882, 14651883, 14651799, 14652154, 14651595, 14651760, 14652271, 14652272, 14652273, 14652056, 14651800, 14651801, 14651802, 14651884, 14651885, 14651886, 14652274, 14652275, 14652276, 14652277, 14652278, 14651894, 14651723, 14652211, 14651895, 14651916, 14651887, 14651888, 14651596, 14651889, 14652212, 14651761, 14652310, 14652311, 14651973, 14651974, 14652312, 14652313, 14651896, 14651803] into rvc-qpr3-release
Change-Id: If4b77f492ba67051f13fe05bc3371dc3acd61c6c
|
|
Below is a diagram showing what scatter gather would look like where we
have one reference to a buffer, and then we have a single embedded
buffer. For instance, 'a1' might be the hidl_vec object and 'a2' might
be the data pointer in this object. In practice, there might be
arbitrarily many levels (this happens when structures contain vectors
which contain structures etc...).
legend:
"...." - random data we don't care about
"|" - some position in the data
"<a#>" - some constant address
offsets into Parcel's mData:
.....|....<a1>....|.....|....<a2>....|.....
^ ^ ^ ^
| | | \- 'buffer' field of structure
| | |
| | | (binder object structure)
| | \- mObjects[child]
| |
| \- binder object structure 'buffer' field
|
\- mObjects[parent] (binder object structure)
kernel-owned ro buffer @ address a1 ('parent' buffer)
.......<a3>....................
^
\- parent buffer as address + parent offset
(in the example, this would be the data field
of hidl_vec. This should be a2).
kernel-owned ro buffer @ address a2 ('child' buffer)
............................
(any random data)
What was happening here was that by maliciously constructing
mObjects[child] to be null, there would be no child object, so the
kernel wouldn't know to fixup the embedded buffer (<a3>) and it
would be unchanged.
Bug: 179289794
Test: repro w/ POC, and this fixes it
Test: hidl_test
Change-Id: Ia26e0fc902510b90ce5bbd55343fa6ded8e4fcf5
(cherry picked from commit 25614cbc380db86cc3842ac1886b55d92c913e4d)
(cherry picked from commit fcd86bd0d1b4cfea480a2682c354fb40039f0727)
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c am: 8115a42569 am: 8ad84271c3 am: 8a5d7fbdcb
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I77b0f88739be58a57e3d19ab28b07a6d0a39e3ec
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c am: 8115a42569 am: 8ad84271c3
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I5ca871564f5b147885fa0208cd0ad09563808901
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c am: b85ad8670a am: 0eb97f9ed1
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I03181852af9641644d8d03be8af6bc61a25bfd51
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c am: b85ad8670a
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: Ica7b015ab06332f30b3118f9371b6be6e286f100
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c am: 8115a42569
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I15e37dd85f521b50cdd412183060e3b899cb01bd
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I115936f97e98d1b830ece2b407f8d974ec7866d8
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6 am: f39fa2cd1c
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: Ie2860f57c542e4243caf4de4656c22c752fb4c13
|
|
68b6a9027e am: 2e1f5e023c am: 41202fc9c6
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I30396472b8ca4399d1c17d8921b24f96faa0b95e
|
|
68b6a9027e am: 2e1f5e023c
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I682e70f9df8962a39c908e8dac7c47162a954646
|
|
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: Ia271a3fcfa21244f0ce4219d0e153fb2d3efb837
|
|
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/libhwbinder/+/14314385
Change-Id: I32b1e5c15020bf34a2ab19663fa95f6e0fa9a552
|
|
Below is a diagram showing what scatter gather would look like where we
have one reference to a buffer, and then we have a single embedded
buffer. For instance, 'a1' might be the hidl_vec object and 'a2' might
be the data pointer in this object. In practice, there might be
arbitrarily many levels (this happens when structures contain vectors
which contain structures etc...).
legend:
"...." - random data we don't care about
"|" - some position in the data
"<a#>" - some constant address
offsets into Parcel's mData:
.....|....<a1>....|.....|....<a2>....|.....
^ ^ ^ ^
| | | \- 'buffer' field of structure
| | |
| | | (binder object structure)
| | \- mObjects[child]
| |
| \- binder object structure 'buffer' field
|
\- mObjects[parent] (binder object structure)
kernel-owned ro buffer @ address a1 ('parent' buffer)
.......<a3>....................
^
\- parent buffer as address + parent offset
(in the example, this would be the data field
of hidl_vec. This should be a2).
kernel-owned ro buffer @ address a2 ('child' buffer)
............................
(any random data)
What was happening here was that by maliciously constructing
mObjects[child] to be null, there would be no child object, so the
kernel wouldn't know to fixup the embedded buffer (<a3>) and it
would be unchanged.
Bug: 179289794
Test: repro w/ POC, and this fixes it
Test: hidl_test
Change-Id: Ia26e0fc902510b90ce5bbd55343fa6ded8e4fcf5
(cherry picked from commit 25614cbc380db86cc3842ac1886b55d92c913e4d)
|