libbinder: RPC avoid FdTrigger shutdown race

RpcSession's FdTrigger can't have simultaneous calls to trigger. This
will cause a double-close of the FD. Take locks to avoid this case.

Bug: 200368820
Test: binderRpcTest, binder_rpc_fuzzer, binder_bpBinderFuzz
Change-Id: I94822f441142b3a1352e38adacb8e17f285d66ac

1 files changed, 3 insertions, 0 deletions

diff --git a/libs/binder/RpcServer.cpp b/libs/binder/RpcServer.cpp
index 5733993b3b..4c61a5902f 100644
--- a/libs/binder/RpcServer.cpp
+++ b/libs/binder/RpcServer.cpp
@@ -205,8 +205,11 @@ bool RpcServer::shutdown() {
     }
 
     mShutdownTrigger->trigger();
+
     for (auto& [id, session] : mSessions) {
         (void)id;
+        // server lock is a more general lock
+        std::lock_guard<std::mutex> _lSession(session->mMutex);
         session->mShutdownTrigger->trigger();
     }