From b5322b2be5e16ee809eabbee4fca8b523a1d8290 Mon Sep 17 00:00:00 2001 From: songjinshi Date: Wed, 15 Mar 2017 16:16:05 +0800 Subject: [Stability]: fix system_server crash issue caused by fd leak. If an app incorrect use of registerListener, it will cause system_server socket fd leak, for example: protected void onResume() { super.onResume(); mSensorManager.registerListener(new MySensorEventListener(), mSensor, SensorManager.SENSOR_DELAY_UI); Each time a new SensorEventQueue, then in the system_server will open a new socket fd, as time increases system_server's fd will be more than 1024 and crash, so we needed add count limit for sensor listener to improve the system stability. Test: use the apk attached in the issue https://code.google.com/p/android/issues/detail?id=258634 Bug: 37543280 Change-Id: I35006966a1638c25bb0f54611e117e16a764e12b Signed-off-by: songjinshi --- core/java/android/hardware/SystemSensorManager.java | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/core/java/android/hardware/SystemSensorManager.java b/core/java/android/hardware/SystemSensorManager.java index 51506b00b892..80cbde75efd2 100644 --- a/core/java/android/hardware/SystemSensorManager.java +++ b/core/java/android/hardware/SystemSensorManager.java @@ -16,12 +16,10 @@ package android.hardware; -import android.Manifest; import android.content.BroadcastReceiver; import android.content.Context; import android.content.Intent; import android.content.IntentFilter; -import android.content.pm.PackageManager; import android.os.Handler; import android.os.Looper; import android.os.MemoryFile; @@ -51,8 +49,9 @@ import java.util.Map; */ public class SystemSensorManager extends SensorManager { //TODO: disable extra logging before release - private static boolean DEBUG_DYNAMIC_SENSOR = true; - private static int MIN_DIRECT_CHANNEL_BUFFER_SIZE = 104; + private static final boolean DEBUG_DYNAMIC_SENSOR = true; + private static final int MIN_DIRECT_CHANNEL_BUFFER_SIZE = 104; + private static final int MAX_LISTENER_COUNT = 128; private static native void nativeClassInit(); private static native long nativeCreate(String opPackageName); @@ -157,6 +156,11 @@ public class SystemSensorManager extends SensorManager { Log.e(TAG, "maxBatchReportLatencyUs and delayUs should be non-negative"); return false; } + if (mSensorListeners.size() >= MAX_LISTENER_COUNT) { + throw new IllegalStateException("register failed, " + + "the sensor listeners size has exceeded the maximum limit " + + MAX_LISTENER_COUNT); + } // Invariants to preserve: // - one Looper per SensorEventListener @@ -216,6 +220,12 @@ public class SystemSensorManager extends SensorManager { if (sensor.getReportingMode() != Sensor.REPORTING_MODE_ONE_SHOT) return false; + if (mTriggerListeners.size() >= MAX_LISTENER_COUNT) { + throw new IllegalStateException("request failed, " + + "the trigger listeners size has exceeded the maximum limit " + + MAX_LISTENER_COUNT); + } + synchronized (mTriggerListeners) { TriggerEventQueue queue = mTriggerListeners.get(listener); if (queue == null) { -- cgit v1.2.3-59-g8ed1b