Fix crash in bindService due to uncleared binder identity
Clear the calling identity in retrieveServiceLocked before
doing the appop check. It probably needs to be cleared sooner
in general in retrieveServiceLocked(), but that might be a risky
fix. Making this smaller fix to keep it surgical for now.
Bug: 25759739
Change-Id: I66a5f8ef9b2d914181925fa344c3f2962030583d
diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 4d05f9a..17b3d2a 100755
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -1094,15 +1094,20 @@
}
r = smap.mServicesByName.get(name);
if (r == null && createIfNeeded) {
- // Before going further -- if this app is not allowed to run in the background,
- // then at this point we aren't going to let it period.
- if (!mAm.checkAllowBackgroundLocked(sInfo.applicationInfo.uid,
- sInfo.packageName, callingPid)) {
- Slog.w(TAG, "Background execution not allowed: service "
- + r.intent + " to " + name.flattenToShortString()
- + " from pid=" + callingPid + " uid=" + callingUid
- + " pkg=" + callingPackage);
- return null;
+ final long token = Binder.clearCallingIdentity();
+ try {
+ // Before going further -- if this app is not allowed to run in the
+ // background, then at this point we aren't going to let it period.
+ if (!mAm.checkAllowBackgroundLocked(sInfo.applicationInfo.uid,
+ sInfo.packageName, callingPid)) {
+ Slog.w(TAG, "Background execution not allowed: service "
+ + r.intent + " to " + name.flattenToShortString()
+ + " from pid=" + callingPid + " uid=" + callingUid
+ + " pkg=" + callingPackage);
+ return null;
+ }
+ } finally {
+ Binder.restoreCallingIdentity(token);
}
Intent.FilterComparison filter