diff options
| author | 2022-09-13 01:05:53 +0000 | |
|---|---|---|
| committer | 2022-09-13 01:05:53 +0000 | |
| commit | e9f50efbe2b906ded7ccacbd516c3dade890e7eb (patch) | |
| tree | cd490796cebcf50f8cae2b67770cf46812e0d169 /libs/binder/IPCThreadState.cpp | |
| parent | 6f122f2368220bf795514e5809b45d0c85996670 (diff) | |
| parent | e14ff5c8724321df896abb64ba1e0bf4c0c3f7a7 (diff) | |
Merge "libbinder: fix buffer free race" am: c6fc862bf0 am: 245dff1ff8 am: e14ff5c872
Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2210443
Change-Id: Icd121fa635f35f3990170a9164ac3ba9f5922a6f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
Diffstat (limited to 'libs/binder/IPCThreadState.cpp')
| -rw-r--r-- | libs/binder/IPCThreadState.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp index b50cfb3d19..bfcf39ad30 100644 --- a/libs/binder/IPCThreadState.cpp +++ b/libs/binder/IPCThreadState.cpp @@ -1318,6 +1318,13 @@ status_t IPCThreadState::executeCommand(int32_t cmd) LOG_ONEWAY("Sending reply to %d!", mCallingPid); if (error < NO_ERROR) reply.setError(error); + // b/238777741: clear buffer before we send the reply. + // Otherwise, there is a race where the client may + // receive the reply and send another transaction + // here and the space used by this transaction won't + // be freed for the client. + buffer.setDataSize(0); + constexpr uint32_t kForwardReplyFlags = TF_CLEAR_BUF; sendReply(reply, (tr.flags & kForwardReplyFlags)); } else { |