From c59f04f94806d75a1387a21863dbb436ad7590fa Mon Sep 17 00:00:00 2001 From: yutingfang Date: Thu, 23 Jan 2025 11:18:35 -0800 Subject: [DO NOT MERGE] Impose a threshold on the number of attributed op entries returned in a binder call In the binder call IAppOpsService#getPackagesForOpsForDevice, we return attributed op entries encapsulated in PackageOps. When there are too many attribution tags used for a lot of ops, the size of PackageOps can be bloated and exceeds the binder transaction limit. However, this is usually caused by DoS attack from malicious apps. A normal app wouldn't run into this problem. This CL adds a threshold on the number of attributed op entries that can be returned in a binder call. The threshold is calculated assuming each attribution tag is 50 bytes long. Bug: 372678095 Test: manual. Using provided POC app from the reporter. Verified the exception is gone after the fix. Flag: EXEMPT bugfix (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:eec34e2716bfa613be30b0a0b9a173e2005a6c00) Merged-In: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c Change-Id: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c --- .../com/android/server/appop/AppOpsService.java | 28 ++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/appop/AppOpsService.java b/services/core/java/com/android/server/appop/AppOpsService.java index 055b7ea37d34..6f7d72cc43a9 100644 --- a/services/core/java/com/android/server/appop/AppOpsService.java +++ b/services/core/java/com/android/server/appop/AppOpsService.java @@ -232,6 +232,12 @@ public class AppOpsService extends IAppOpsService.Stub { * {@link #upgradeLocked(int)} below. The first version was 1 */ private static final int CURRENT_VERSION = 1; + /** + * The upper limit of total number of attributed op entries that can be returned in a binder + * transaction to avoid TransactionTooLargeException + */ + private static final int NUM_ATTRIBUTED_OP_ENTRY_THRESHOLD = 2000; + // Write at most every 30 minutes. static final long WRITE_DELAY = DEBUG ? 1000 : 30*60*1000; @@ -2192,6 +2198,8 @@ public class AppOpsService extends IAppOpsService.Stub { Manifest.permission.GET_APP_OPS_STATS, Binder.getCallingPid(), Binder.getCallingUid()) == PackageManager.PERMISSION_GRANTED; + int totalAttributedOpEntryCount = 0; + if (ops == null) { resOps = new ArrayList<>(); for (int j = 0; j < pkgOps.size(); j++) { @@ -2199,7 +2207,12 @@ public class AppOpsService extends IAppOpsService.Stub { if (opRestrictsRead(curOp.op) && !shouldReturnRestrictedAppOps) { continue; } - resOps.add(getOpEntryForResult(curOp, elapsedNow)); + if (totalAttributedOpEntryCount > NUM_ATTRIBUTED_OP_ENTRY_THRESHOLD) { + break; + } + OpEntry opEntry = getOpEntryForResult(curOp, elapsedNow); + resOps.add(opEntry); + totalAttributedOpEntryCount += opEntry.getAttributedOpEntries().size(); } } else { for (int j = 0; j < ops.length; j++) { @@ -2211,10 +2224,21 @@ public class AppOpsService extends IAppOpsService.Stub { if (resOps == null) { resOps = new ArrayList<>(); } - resOps.add(getOpEntryForResult(curOp, elapsedNow)); + if (totalAttributedOpEntryCount > NUM_ATTRIBUTED_OP_ENTRY_THRESHOLD) { + break; + } + OpEntry opEntry = getOpEntryForResult(curOp, elapsedNow); + resOps.add(opEntry); + totalAttributedOpEntryCount += opEntry.getAttributedOpEntries().size(); } } } + + if (totalAttributedOpEntryCount > NUM_ATTRIBUTED_OP_ENTRY_THRESHOLD) { + Slog.w(TAG, "The number of attributed op entries has exceeded the threshold. This " + + "could be due to DoS attack from malicious apps. The result is throttled."); + } + return resOps; } -- cgit v1.2.3-59-g8ed1b