LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enforce ConnectivityManager.releaseNetworkRequest callers own the NetworkRequest

Browse Source 
Enforce that callers of ConnectivityManager.releaseNetworkRequest() are the
creators of the NetworkRequest being released by matching UIDs.

Change-Id: I439468c054bacc035e2db2c4967b24d183e78e9c
This commit is contained in:
Paul Jensen
2014-05-16 14:31:12 -04:00
parent 10ba60a4a1
commit 961cb0dbcb
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -409,7 +409,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
/** /**
* used to remove a network request, either a listener or a real request * used to remove a network request, either a listener or a real request
* includes a NetworkRequest * arg1 = UID of caller
* obj = NetworkRequest
*/ */
private static final int EVENT_RELEASE_NETWORK_REQUEST = 22; private static final int EVENT_RELEASE_NETWORK_REQUEST = 22;
@@ -3333,10 +3334,15 @@ public class ConnectivityService extends IConnectivityManager.Stub {
} }
} }
private void handleReleaseNetworkRequest(NetworkRequest request) { private void handleReleaseNetworkRequest(NetworkRequest request, int callingUid) {
if (DBG) log("releasing NetworkRequest " + request); NetworkRequestInfo nri = mNetworkRequests.get(request);
NetworkRequestInfo nri = mNetworkRequests.remove(request);
if (nri != null) { if (nri != null) {
if (nri.mUid != callingUid) {
if (DBG) log("Attempt to release unowned NetworkRequest " + request);
return;
}
if (DBG) log("releasing NetworkRequest " + request);
mNetworkRequests.remove(request);
// tell the network currently servicing this that it's no longer interested // tell the network currently servicing this that it's no longer interested
NetworkAgentInfo affectedNetwork = mNetworkForRequestId.get(nri.request.requestId); NetworkAgentInfo affectedNetwork = mNetworkForRequestId.get(nri.request.requestId);
if (affectedNetwork != null) { if (affectedNetwork != null) {
@@ -3482,7 +3488,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
break; break;
} }
case EVENT_RELEASE_NETWORK_REQUEST: { case EVENT_RELEASE_NETWORK_REQUEST: {
handleReleaseNetworkRequest((NetworkRequest) msg.obj); handleReleaseNetworkRequest((NetworkRequest) msg.obj, msg.arg1);
break; break;
} }
} }
@@ -5460,8 +5466,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
@Override @Override
public void releaseNetworkRequest(NetworkRequest networkRequest) { public void releaseNetworkRequest(NetworkRequest networkRequest) {
mHandler.sendMessage(mHandler.obtainMessage(EVENT_RELEASE_NETWORK_REQUEST, mHandler.sendMessage(mHandler.obtainMessage(EVENT_RELEASE_NETWORK_REQUEST, getCallingUid(),
networkRequest)); 0, networkRequest));
} }
@Override @Override