Properly resolve the userId when running on concurrent multi-user

In concurrent multi-user mode, `showSoftInput` and `hideSoftInput`
derive the userId from the binder caller's user id. However,
this fails when the caller is the system user (user 0), especially
when `startInputOrWindowFocusGained` was previously called by the
system user while while passing another user id for the `userId`
parameter.

This changelist modifies `showSoftInput` and `hideSoftInput` to
instead resolve the userId from the display owner within the
`client` parameter.

The long-term solution involves implementing per-user and
per-window IME binding in IMMS, and adding a `userId` parameter to
both the showSoftInput and hideSoftInput methods (this will allow
apps started by system user to specify another user when invoking
these two methods).

This changelist shouldn't introduce any breakage on phones or tablets.

Test: presubmit
Test: atest CtsInputMethodTestCases
Bug: 358105425
Flag: EXEMPT bug fix
Change-Id: I03f6f4b08470afc36eb8d7381b14556804d6b2c2

1 files changed, 27 insertions, 3 deletions

diff --git a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
index 7ce9ee60d421..2ad0d2a1b658 100644
--- a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
+++ b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
@@ -326,7 +326,7 @@ public final class InputMethodManagerService implements IInputMethodManagerImpl.
      * Figures out the target IME user ID for a given {@link Binder} IPC.
      *
      * @param callingProcessUserId the user ID of the calling process
-     * @return User ID to be used for this {@link Binder} call.
+     * @return the user ID to be used for this {@link Binder} call
      */
     @GuardedBy("ImfLock.class")
     @UserIdInt
@@ -336,6 +336,30 @@ public final class InputMethodManagerService implements IInputMethodManagerImpl.
     }
 
     /**
+     * Figures out the targetIMuser for a given {@link Binder} IPC. In case
+     * {@code callingProcessUserId} is SYSTEM user, then it will return the owner of the display
+     * associated with the {@code client} passed as parameter.
+     *
+     * @param callingProcessUserId the user ID of the calling process
+     * @param client               the input method client used to retrieve the user id in case
+     *                             {@code callingProcessUserId} is assigned to SYSTEM user
+     * @return the user ID to be used for this {@link Binder} call
+     */
+    @GuardedBy("ImfLock.class")
+    @UserIdInt
+    @BinderThread
+    private int resolveImeUserIdLocked(@UserIdInt int callingProcessUserId,
+            @NonNull IInputMethodClient client) {
+        if (mConcurrentMultiUserModeEnabled
+                && callingProcessUserId == UserHandle.USER_SYSTEM) {
+            final var clientState = mClientController.getClient(client.asBinder());
+            return mUserManagerInternal.getUserAssignedToDisplay(
+                    clientState.mSelfReportedDisplayId);
+        }
+        return callingProcessUserId;
+    }
+
+   /**
      * Figures out the target IME user ID associated with the given {@code displayId}.
      *
      * @param displayId the display ID to be queried about
@@ -3069,7 +3093,7 @@ public final class InputMethodManagerService implements IInputMethodManagerImpl.
         synchronized (ImfLock.class) {
             final int uid = Binder.getCallingUid();
             final int callingUserId = UserHandle.getUserId(uid);
-            final int userId = resolveImeUserIdLocked(callingUserId);
+            final int userId = resolveImeUserIdLocked(callingUserId, client);
             final boolean result = showSoftInputLocked(client, windowToken, statsToken, flags,
                     lastClickToolType, resultReceiver, reason, uid, userId);
             // When ZeroJankProxy is enabled, the app has already received "true" as the return
@@ -3515,7 +3539,7 @@ public final class InputMethodManagerService implements IInputMethodManagerImpl.
         synchronized (ImfLock.class) {
             final int uid = Binder.getCallingUid();
             final int callingUserId = UserHandle.getUserId(uid);
-            final int userId = resolveImeUserIdLocked(callingUserId);
+            final int userId = resolveImeUserIdLocked(callingUserId, client);
             final boolean result = hideSoftInputLocked(client, windowToken, statsToken, flags,
                     resultReceiver, reason, uid, userId);
             // When ZeroJankProxy is enabled, the app has already received "true" as the return