commit f690c468780ceb12554d1277256a24a66d49d149
author Eric Laurent <elaurent@google.com> Fri Sep 17 14:47:03 2021 +0200
committer Eric Laurent <elaurent@google.com> Fri Sep 17 17:48:23 2021 +0000
tree 08707c75f58d01ace38cad8f80b8489498f01e6a
parent bd1eee2ae0fc2445610ba4a5a3216e1ab65cd45c

AudioFlinger: limit ability to create a Spatializer effect

A Spatializer effect can only be created from audio policy service
and on a spatializer thread.

Bug: 188502620
Test: make
Change-Id: Ia64ea3b68a536a34a14be104151a582e023c9dad

services/audioflinger/AudioFlinger.cpp

diff --git a/services/audioflinger/AudioFlinger.cpp b/services/audioflinger/AudioFlinger.cpp
index a77a27d..676bf78 100644
--- a/services/audioflinger/AudioFlinger.cpp
+++ b/services/audioflinger/AudioFlinger.cpp
@@ -64,6 +64,7 @@
 #include <system/audio_effects/effect_ns.h>
 #include <system/audio_effects/effect_aec.h>
 #include <system/audio_effects/effect_hapticgenerator.h>
+#include <system/audio_effects/effect_spatializer.h>
 
 #include <audio_utils/primitives.h>
 
@@ -3745,6 +3746,15 @@
             goto Exit;
         }
 
+        // Only audio policy service can create a spatializer effect
+        if ((memcmp(&descOut.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) &&
+            (callingUid != AID_AUDIOSERVER || currentPid != getpid())) {
+            ALOGW("%s: attempt to create a spatializer effect from uid/pid %d/%d",
+                    __func__, callingUid, currentPid);
+            lStatus = PERMISSION_DENIED;
+            goto Exit;
+        }
+
         if (io == AUDIO_IO_HANDLE_NONE && sessionId == AUDIO_SESSION_OUTPUT_MIX) {
             // if the output returned by getOutputForEffect() is removed before we lock the
             // mutex below, the call to checkPlaybackThread_l(io) below will detect it