commit d1126e7160b87313de91be5dbf7d0d9b08900f70
author Martijn Coenen <maco@google.com> Fri May 29 14:49:25 2020 +0200
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jun 10 00:36:13 2020 +0000
tree c9f7cd4bcc3cfb56b4fc64f82e867b31ae75f4a9
parent c4d6e387984e09e86a58e6485555a2d651f0481f

Use killProcessGroup when killing app zygote.

To make sure we kill all untracked children, too.

Bug: 156741968
Bug: 157598956
Test: manual inspection, PoC no longer works.
Change-Id: I5d8efeb05ddec08a7fc7c00eabca6590c4cfdd8c
(cherry picked from commit 0a91f61ac8387c02528e0f6f0948296ba9d5ca77)

core/java/android/os/AppZygote.java

diff --git a/core/java/android/os/AppZygote.java b/core/java/android/os/AppZygote.java
index 6daa5b4..66f50e4 100644
--- a/core/java/android/os/AppZygote.java
+++ b/core/java/android/os/AppZygote.java
@@ -90,10 +90,9 @@
     @GuardedBy("mLock")
     private void stopZygoteLocked() {
         if (mZygote != null) {
-            // Close the connection and kill the zygote process. This will not cause
-            // child processes to be killed by itself.
             mZygote.close();
-            Process.killProcess(mZygote.getPid());
+            // use killProcessGroup() here, so we kill all untracked children as well.
+            Process.killProcessGroup(mZygoteUid, mZygote.getPid());
             mZygote = null;
         }
     }