Fix AttributionSource usage in WifiAware
Avoid unparcelling AttributionSource outside of a Binder transaction.
Bug: 267231571
Bug: 244465118
Test: atest com.android.server.wifi
Change-Id: I242cb8033022f7a7e2fd1389b75beb0660ee45f2
Merged-In: I242cb8033022f7a7e2fd1389b75beb0660ee45f2
(cherry picked from commit 0751d16cb57e415be037f4f7c962ee55a1f5fe03)
diff --git a/service/java/com/android/server/wifi/aware/WifiAwareClientState.java b/service/java/com/android/server/wifi/aware/WifiAwareClientState.java
index 9ba17de..51d4900 100644
--- a/service/java/com/android/server/wifi/aware/WifiAwareClientState.java
+++ b/service/java/com/android/server/wifi/aware/WifiAwareClientState.java
@@ -26,7 +26,6 @@
import android.net.wifi.aware.ConfigRequest;
import android.net.wifi.aware.IWifiAwareEventCallback;
import android.net.wifi.util.HexEncoding;
-import android.os.Bundle;
import android.os.RemoteException;
import android.util.Log;
import android.util.SparseArray;
@@ -66,7 +65,7 @@
private final @Nullable String mCallingFeatureId;
private final boolean mNotifyIdentityChange;
private final WifiPermissionsUtil mWifiPermissionsUtil;
- private final Bundle mExtra;
+ private final Object mAttributionSource;
private final AppOpsManager mAppOps;
private final long mCreationTime;
@@ -78,7 +77,7 @@
String callingPackage, @Nullable String callingFeatureId,
IWifiAwareEventCallback callback, ConfigRequest configRequest,
boolean notifyIdentityChange, long creationTime,
- WifiPermissionsUtil wifiPermissionsUtil, Bundle extra) {
+ WifiPermissionsUtil wifiPermissionsUtil, Object attributionSource) {
mContext = context;
mClientId = clientId;
mUid = uid;
@@ -92,7 +91,7 @@
mAppOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
mCreationTime = creationTime;
mWifiPermissionsUtil = wifiPermissionsUtil;
- mExtra = extra;
+ mAttributionSource = attributionSource;
}
/**
@@ -147,8 +146,8 @@
return mSessions;
}
- public Bundle getExtra() {
- return mExtra;
+ public Object getAttributionSource() {
+ return mAttributionSource;
}
/**
* Searches the discovery sessions of this client and returns the one
diff --git a/service/java/com/android/server/wifi/aware/WifiAwareStateManager.java b/service/java/com/android/server/wifi/aware/WifiAwareStateManager.java
index 791c18d..f0b7f17 100644
--- a/service/java/com/android/server/wifi/aware/WifiAwareStateManager.java
+++ b/service/java/com/android/server/wifi/aware/WifiAwareStateManager.java
@@ -21,6 +21,7 @@
import android.annotation.NonNull;
import android.annotation.Nullable;
+import android.content.AttributionSource;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
@@ -226,7 +227,6 @@
private static final String MESSAGE_BUNDLE_KEY_NDP_IDS = "ndp_ids";
private static final String MESSAGE_BUNDLE_KEY_APP_INFO = "app_info";
private static final String MESSAGE_BUNDLE_KEY_ACCEPT_STATE = "accept_state";
- private static final String MESSAGE_BUNDLE_KEY_ATTRIBUTION_SOURCE = "attribution_source";
private WifiAwareNativeApi mWifiAwareNativeApi;
private WifiAwareNativeManager mWifiAwareNativeManager;
@@ -820,7 +820,9 @@
Message msg = mSm.obtainMessage(MESSAGE_TYPE_COMMAND);
msg.arg1 = COMMAND_TYPE_CONNECT;
msg.arg2 = clientId;
- msg.obj = callback;
+ Pair<IWifiAwareEventCallback, Object> callbackAndAttributionSource = new Pair<>(
+ callback, extra.getParcelable(WifiManager.EXTRA_PARAM_KEY_ATTRIBUTION_SOURCE));
+ msg.obj = callbackAndAttributionSource;
msg.getData().putParcelable(MESSAGE_BUNDLE_KEY_CONFIG, configRequest);
msg.getData().putInt(MESSAGE_BUNDLE_KEY_UID, uid);
msg.getData().putInt(MESSAGE_BUNDLE_KEY_PID, pid);
@@ -828,7 +830,6 @@
msg.getData().putString(MESSAGE_BUNDLE_KEY_CALLING_FEATURE_ID, callingFeatureId);
msg.getData().putBoolean(MESSAGE_BUNDLE_KEY_NOTIFY_IDENTITY_CHANGE,
notifyOnIdentityChanged);
- msg.getData().putBundle(MESSAGE_BUNDLE_KEY_ATTRIBUTION_SOURCE, extra);
mSm.sendMessage(msg);
}
@@ -1844,7 +1845,9 @@
}
int clientId = msg.arg2;
- IWifiAwareEventCallback callback = (IWifiAwareEventCallback) msg.obj;
+ Pair<IWifiAwareEventCallback, Object> callbackAndAttributionSource =
+ (Pair<IWifiAwareEventCallback, Object>) msg.obj;
+ IWifiAwareEventCallback callback = callbackAndAttributionSource.first;
ConfigRequest configRequest = (ConfigRequest) msg.getData()
.getParcelable(MESSAGE_BUNDLE_KEY_CONFIG);
int uid = msg.getData().getInt(MESSAGE_BUNDLE_KEY_UID);
@@ -1878,8 +1881,7 @@
== InterfaceConflictManager.ICM_EXECUTE_COMMAND) {
waitForResponse = connectLocal(mCurrentTransactionId, clientId, uid, pid,
callingPackage, callingFeatureId, callback, configRequest,
- notifyIdentityChange,
- msg.getData().getBundle(MESSAGE_BUNDLE_KEY_ATTRIBUTION_SOURCE));
+ notifyIdentityChange, callbackAndAttributionSource.second);
} else { // InterfaceConflictManager.ICM_SKIP_COMMAND_WAIT_FOR_USER
waitForResponse = false;
}
@@ -2501,7 +2503,7 @@
private boolean connectLocal(short transactionId, int clientId, int uid, int pid,
String callingPackage, @Nullable String callingFeatureId,
IWifiAwareEventCallback callback, ConfigRequest configRequest,
- boolean notifyIdentityChange, Bundle extra) {
+ boolean notifyIdentityChange, Object attributionSource) {
if (VDBG) {
Log.v(TAG, "connectLocal(): transactionId=" + transactionId + ", clientId=" + clientId
+ ", uid=" + uid + ", pid=" + pid + ", callingPackage=" + callingPackage
@@ -2553,7 +2555,7 @@
}
WifiAwareClientState client = new WifiAwareClientState(mContext, clientId, uid, pid,
callingPackage, callingFeatureId, callback, configRequest, notifyIdentityChange,
- SystemClock.elapsedRealtime(), mWifiPermissionsUtil, extra);
+ SystemClock.elapsedRealtime(), mWifiPermissionsUtil, attributionSource);
client.enableVerboseLogging(mDbg);
client.onInterfaceAddressChange(mCurrentDiscoveryInterfaceMac);
mClients.append(clientId, client);
@@ -2959,7 +2961,9 @@
Bundle data = completedCommand.getData();
int clientId = completedCommand.arg2;
- IWifiAwareEventCallback callback = (IWifiAwareEventCallback) completedCommand.obj;
+ Pair<IWifiAwareEventCallback, Object> callbackAndAttributionSource =
+ (Pair<IWifiAwareEventCallback, Object>) completedCommand.obj;
+ IWifiAwareEventCallback callback = callbackAndAttributionSource.first;
ConfigRequest configRequest = (ConfigRequest) data
.getParcelable(MESSAGE_BUNDLE_KEY_CONFIG);
int uid = data.getInt(MESSAGE_BUNDLE_KEY_UID);
@@ -2972,7 +2976,7 @@
WifiAwareClientState client = new WifiAwareClientState(mContext, clientId, uid, pid,
callingPackage, callingFeatureId, callback, configRequest, notifyIdentityChange,
SystemClock.elapsedRealtime(), mWifiPermissionsUtil,
- data.getBundle(MESSAGE_BUNDLE_KEY_ATTRIBUTION_SOURCE));
+ callbackAndAttributionSource.second);
client.enableVerboseLogging(mDbg);
mClients.put(clientId, client);
mAwareMetrics.recordAttachSession(uid, notifyIdentityChange, mClients);
@@ -3018,8 +3022,9 @@
}
if (failedCommand.arg1 == COMMAND_TYPE_CONNECT) {
- IWifiAwareEventCallback callback = (IWifiAwareEventCallback) failedCommand.obj;
-
+ Pair<IWifiAwareEventCallback, Object> callbackAndAttributionSource =
+ (Pair<IWifiAwareEventCallback, Object>) failedCommand.obj;
+ IWifiAwareEventCallback callback = callbackAndAttributionSource.first;
try {
callback.onConnectFail(reason);
mAwareMetrics.recordAttachStatus(reason);
@@ -3754,12 +3759,17 @@
private void handleLocationModeDisabled() {
for (int i = 0; i < mClients.size(); i++) {
WifiAwareClientState clientState = mClients.valueAt(i);
- try {
- // As location mode is disabled, only app disavowal the location can pass the check.
- mWifiPermissionsUtil.enforceNearbyDevicesPermission(clientState.getExtra()
- .getParcelable(WifiManager.EXTRA_PARAM_KEY_ATTRIBUTION_SOURCE), true,
- "Wifi Aware location mode change.");
- } catch (SecurityException e) {
+ if (SdkLevel.isAtLeastT()) {
+ try {
+ // As location mode is disabled, only app disavowal the location can pass the
+ // check.
+ mWifiPermissionsUtil.enforceNearbyDevicesPermission(
+ (AttributionSource) clientState.getAttributionSource(), true,
+ "Wifi Aware location mode change.");
+ } catch (SecurityException e) {
+ disconnect(clientState.getClientId());
+ }
+ } else {
disconnect(clientState.getClientId());
}
}
