[ActivityManager] Avoid killing unrelated processes.
Kernel will reuse process id, when wrap-around happens,
there may be just after a pid is freed, a new thread/process
uses the pid immediately.
For examples, there may be a process with pid 1234 killed
by lowmemorykiller or itself (app.killed=false).
Before the death recipient enters AMS, a new thread/process
is started with pid 1234, then when appDiedLocked executes,
this new pid 1234 will be killed again.
It is especially easy happens to zygote:
During zygote starting process, it will stop 5 daemons threads.
And restart the 5 threads after fork is called, so it has
larger pid range to hit the resue case.
https://code.google.com/p/android/issues/detail?id=160661
Solution:
If the dead event is from binder, it is not necessary
to call killProcessQuiet again, because it should really
be dead.
Keep no checking for killProcessGroup because zygote does
not have record under /acct/, and also the parameter uid
has restriction that will not kill another application
which reuses the pid.
Change-Id: Iec4a4884ae641c4d036f4d024ce463f7a351a17b
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 34a5249..dbf962b 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -1215,7 +1215,7 @@
TAG, "Death received in " + this
+ " for thread " + mAppThread.asBinder());
synchronized(ActivityManagerService.this) {
- appDiedLocked(mApp, mPid, mAppThread);
+ appDiedLocked(mApp, mPid, mAppThread, true);
}
}
}
@@ -4678,10 +4678,11 @@
}
final void appDiedLocked(ProcessRecord app) {
- appDiedLocked(app, app.pid, app.thread);
+ appDiedLocked(app, app.pid, app.thread, false);
}
- final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread) {
+ final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread,
+ boolean fromBinderDied) {
// First check if this ProcessRecord is actually active for the pid.
synchronized (mPidsSelfLocked) {
ProcessRecord curProc = mPidsSelfLocked.get(pid);
@@ -4697,7 +4698,9 @@
}
if (!app.killed) {
- Process.killProcessQuiet(pid);
+ if (!fromBinderDied) {
+ Process.killProcessQuiet(pid);
+ }
Process.killProcessGroup(app.info.uid, pid);
app.killed = true;
}