Properly resolve the userId when running on concurrent multi-user
In concurrent multi-user mode, `showSoftInput` and `hideSoftInput`
derive the userId from the binder caller's user id. However,
this fails when the caller is the system user (user 0), especially
when `startInputOrWindowFocusGained` was previously called by the
system user while while passing another user id for the `userId`
parameter.
This changelist modifies `showSoftInput` and `hideSoftInput` to
instead resolve the userId from the display owner within the
`client` parameter.
The long-term solution involves implementing per-user and
per-window IME binding in IMMS, and adding a `userId` parameter to
both the showSoftInput and hideSoftInput methods (this will allow
apps started by system user to specify another user when invoking
these two methods).
This changelist shouldn't introduce any breakage on phones or tablets.
Test: presubmit
Test: atest CtsInputMethodTestCases
Bug: 358105425
Flag: EXEMPT bug fix
Change-Id: I03f6f4b08470afc36eb8d7381b14556804d6b2c2
diff --git a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
index 7ce9ee6..2ad0d2a 100644
--- a/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
+++ b/services/core/java/com/android/server/inputmethod/InputMethodManagerService.java
@@ -326,7 +326,7 @@
* Figures out the target IME user ID for a given {@link Binder} IPC.
*
* @param callingProcessUserId the user ID of the calling process
- * @return User ID to be used for this {@link Binder} call.
+ * @return the user ID to be used for this {@link Binder} call
*/
@GuardedBy("ImfLock.class")
@UserIdInt
@@ -336,6 +336,30 @@
}
/**
+ * Figures out the targetIMuser for a given {@link Binder} IPC. In case
+ * {@code callingProcessUserId} is SYSTEM user, then it will return the owner of the display
+ * associated with the {@code client} passed as parameter.
+ *
+ * @param callingProcessUserId the user ID of the calling process
+ * @param client the input method client used to retrieve the user id in case
+ * {@code callingProcessUserId} is assigned to SYSTEM user
+ * @return the user ID to be used for this {@link Binder} call
+ */
+ @GuardedBy("ImfLock.class")
+ @UserIdInt
+ @BinderThread
+ private int resolveImeUserIdLocked(@UserIdInt int callingProcessUserId,
+ @NonNull IInputMethodClient client) {
+ if (mConcurrentMultiUserModeEnabled
+ && callingProcessUserId == UserHandle.USER_SYSTEM) {
+ final var clientState = mClientController.getClient(client.asBinder());
+ return mUserManagerInternal.getUserAssignedToDisplay(
+ clientState.mSelfReportedDisplayId);
+ }
+ return callingProcessUserId;
+ }
+
+ /**
* Figures out the target IME user ID associated with the given {@code displayId}.
*
* @param displayId the display ID to be queried about
@@ -3069,7 +3093,7 @@
synchronized (ImfLock.class) {
final int uid = Binder.getCallingUid();
final int callingUserId = UserHandle.getUserId(uid);
- final int userId = resolveImeUserIdLocked(callingUserId);
+ final int userId = resolveImeUserIdLocked(callingUserId, client);
final boolean result = showSoftInputLocked(client, windowToken, statsToken, flags,
lastClickToolType, resultReceiver, reason, uid, userId);
// When ZeroJankProxy is enabled, the app has already received "true" as the return
@@ -3515,7 +3539,7 @@
synchronized (ImfLock.class) {
final int uid = Binder.getCallingUid();
final int callingUserId = UserHandle.getUserId(uid);
- final int userId = resolveImeUserIdLocked(callingUserId);
+ final int userId = resolveImeUserIdLocked(callingUserId, client);
final boolean result = hideSoftInputLocked(client, windowToken, statsToken, flags,
resultReceiver, reason, uid, userId);
// When ZeroJankProxy is enabled, the app has already received "true" as the return