Merge "bittube_fuzzer: Fix memory leak"
diff --git a/cmds/bugreportz/readme.md b/cmds/bugreportz/readme.md
index eb0d898..3606827 100644
--- a/cmds/bugreportz/readme.md
+++ b/cmds/bugreportz/readme.md
@@ -1,6 +1,6 @@
# bugreportz protocol
-`bugreportz` is used to generate a zippped bugreport whose path is passed back to `adb`, using
+`bugreportz` is used to generate a zipped bugreport whose path is passed back to `adb`, using
the simple protocol defined below.
# Version 1.1
diff --git a/cmds/servicemanager/ServiceManager.cpp b/cmds/servicemanager/ServiceManager.cpp
index 3cfe529..0727383 100644
--- a/cmds/servicemanager/ServiceManager.cpp
+++ b/cmds/servicemanager/ServiceManager.cpp
@@ -762,4 +762,10 @@
return Status::ok();
}
+void ServiceManager::clear() {
+ mNameToService.clear();
+ mNameToRegistrationCallback.clear();
+ mNameToClientCallback.clear();
+}
+
} // namespace android
diff --git a/cmds/servicemanager/ServiceManager.h b/cmds/servicemanager/ServiceManager.h
index 5e40319..c6db697 100644
--- a/cmds/servicemanager/ServiceManager.h
+++ b/cmds/servicemanager/ServiceManager.h
@@ -58,6 +58,12 @@
void binderDied(const wp<IBinder>& who) override;
void handleClientCallbacks();
+ /**
+ * This API is added for debug purposes. It clears members which hold service and callback
+ * information.
+ */
+ void clear();
+
protected:
virtual void tryStartService(const std::string& name);
diff --git a/cmds/servicemanager/ServiceManagerFuzzer.cpp b/cmds/servicemanager/ServiceManagerFuzzer.cpp
index 39f8522..b76a6bd 100644
--- a/cmds/servicemanager/ServiceManagerFuzzer.cpp
+++ b/cmds/servicemanager/ServiceManagerFuzzer.cpp
@@ -29,6 +29,7 @@
auto accessPtr = std::make_unique<Access>();
auto serviceManager = sp<ServiceManager>::make(std::move(accessPtr));
fuzzService(serviceManager, FuzzedDataProvider(data, size));
+ serviceManager->clear();
return 0;
}
diff --git a/libs/binder/IServiceManager.cpp b/libs/binder/IServiceManager.cpp
index 5db3eef..05db774 100644
--- a/libs/binder/IServiceManager.cpp
+++ b/libs/binder/IServiceManager.cpp
@@ -380,6 +380,13 @@
if (Status status = realGetService(name, &out); !status.isOk()) {
ALOGW("Failed to getService in waitForService for %s: %s", name.c_str(),
status.toString8().c_str());
+ if (0 == ProcessState::self()->getThreadPoolMaxTotalThreadCount()) {
+ ALOGW("Got service, but may be racey because we could not wait efficiently for it. "
+ "Threadpool has 0 guaranteed threads. "
+ "Is the threadpool configured properly? "
+ "See ProcessState::startThreadPool and "
+ "ProcessState::setThreadPoolMaxThreadCount.");
+ }
return nullptr;
}
if (out != nullptr) return out;
@@ -410,7 +417,9 @@
if (waiter->mBinder != nullptr) return waiter->mBinder;
}
- ALOGW("Waited one second for %s (is service started? are binder threads started and available?)", name.c_str());
+ ALOGW("Waited one second for %s (is service started? Number of threads started in the "
+ "threadpool: %zu. Are binder threads started and available?)",
+ name.c_str(), ProcessState::self()->getThreadPoolMaxTotalThreadCount());
// Handle race condition for lazy services. Here is what can happen:
// - the service dies (not processed by init yet).
diff --git a/libs/binder/rust/Android.bp b/libs/binder/rust/Android.bp
index 0ec6183..a135796 100644
--- a/libs/binder/rust/Android.bp
+++ b/libs/binder/rust/Android.bp
@@ -30,6 +30,7 @@
apex_available: [
"//apex_available:platform",
"com.android.compos",
+ "com.android.rkpd",
"com.android.uwb",
"com.android.virt",
],
@@ -80,6 +81,7 @@
apex_available: [
"//apex_available:platform",
"com.android.compos",
+ "com.android.rkpd",
"com.android.uwb",
"com.android.virt",
],
@@ -138,6 +140,7 @@
apex_available: [
"//apex_available:platform",
"com.android.compos",
+ "com.android.rkpd",
"com.android.uwb",
"com.android.virt",
],
diff --git a/libs/binder/rust/rpcbinder/Android.bp b/libs/binder/rust/rpcbinder/Android.bp
index f169390..5ebc27f 100644
--- a/libs/binder/rust/rpcbinder/Android.bp
+++ b/libs/binder/rust/rpcbinder/Android.bp
@@ -16,7 +16,7 @@
],
rustlibs: [
"libbinder_ndk_sys",
- "libbinder_rpc_unstable_bindgen",
+ "libbinder_rpc_unstable_bindgen_sys",
"libbinder_rs",
"libdowncast_rs",
"liblibc",
@@ -29,6 +29,35 @@
min_sdk_version: "Tiramisu",
}
+// Build a separate rust_library rather than depending directly on libbinder_rpc_unstable_bindgen,
+// to work around the fact that rust_bindgen targets only produce rlibs and not dylibs, which would
+// result in duplicate conflicting versions of libbinder_ndk_sys. This will hopefully be fixed in
+// the build system, at which point we can delete this target and go back to using
+// libbinder_rpc_unstable_bindgen directly.
+rust_library {
+ name: "libbinder_rpc_unstable_bindgen_sys",
+ crate_name: "binder_rpc_unstable_bindgen",
+ srcs: [
+ ":libbinder_rpc_unstable_bindgen",
+ ],
+ visibility: [":__subpackages__"],
+ rustlibs: [
+ "libbinder_ndk_sys",
+ ],
+ shared_libs: [
+ "libbinder_rpc_unstable",
+ "libutils",
+ ],
+ apex_available: [
+ "com.android.compos",
+ "com.android.uwb",
+ "com.android.virt",
+ ],
+ min_sdk_version: "Tiramisu",
+ lints: "none",
+ clippy_lints: "none",
+}
+
// TODO(b/184872979): remove once the RPC Binder API is stabilised.
rust_bindgen {
name: "libbinder_rpc_unstable_bindgen",
@@ -36,6 +65,15 @@
crate_name: "binder_rpc_unstable_bindgen",
visibility: [":__subpackages__"],
source_stem: "bindings",
+ bindgen_flags: [
+ "--blocklist-type",
+ "AIBinder",
+ "--raw-line",
+ "use binder_ndk_sys::AIBinder;",
+ ],
+ rustlibs: [
+ "libbinder_ndk_sys",
+ ],
shared_libs: [
"libbinder_rpc_unstable",
"libutils",
@@ -52,6 +90,9 @@
name: "libbinder_rpc_unstable_bindgen_test",
srcs: [":libbinder_rpc_unstable_bindgen"],
crate_name: "binder_rpc_unstable_bindgen",
+ rustlibs: [
+ "libbinder_ndk_sys",
+ ],
test_suites: ["general-tests"],
auto_gen_config: true,
clippy_lints: "none",
diff --git a/libs/binder/rust/rpcbinder/src/client.rs b/libs/binder/rust/rpcbinder/src/client.rs
index dfc6f06..743800b 100644
--- a/libs/binder/rust/rpcbinder/src/client.rs
+++ b/libs/binder/rust/rpcbinder/src/client.rs
@@ -14,10 +14,7 @@
* limitations under the License.
*/
-use binder::{
- unstable_api::{new_spibinder, AIBinder},
- FromIBinder, SpIBinder, StatusCode, Strong,
-};
+use binder::{unstable_api::new_spibinder, FromIBinder, SpIBinder, StatusCode, Strong};
use std::os::{
raw::{c_int, c_void},
unix::io::RawFd,
@@ -27,7 +24,7 @@
pub fn get_vsock_rpc_service(cid: u32, port: u32) -> Option<SpIBinder> {
// SAFETY: AIBinder returned by RpcClient has correct reference count, and the ownership can
// safely be taken by new_spibinder.
- unsafe { new_spibinder(binder_rpc_unstable_bindgen::RpcClient(cid, port) as *mut AIBinder) }
+ unsafe { new_spibinder(binder_rpc_unstable_bindgen::RpcClient(cid, port)) }
}
/// Connects to an RPC Binder server for a particular interface over vsock.
@@ -54,7 +51,7 @@
new_spibinder(binder_rpc_unstable_bindgen::RpcPreconnectedClient(
Some(request_fd_wrapper),
param,
- ) as *mut AIBinder)
+ ))
}
}
diff --git a/libs/binder/rust/rpcbinder/src/server.rs b/libs/binder/rust/rpcbinder/src/server.rs
index d98a439..aeb23c6 100644
--- a/libs/binder/rust/rpcbinder/src/server.rs
+++ b/libs/binder/rust/rpcbinder/src/server.rs
@@ -14,7 +14,10 @@
* limitations under the License.
*/
-use binder::{unstable_api::AsNative, SpIBinder};
+use binder::{
+ unstable_api::{AIBinder, AsNative},
+ SpIBinder,
+};
use std::{os::raw, ptr::null_mut};
/// Runs a binder RPC server, serving the supplied binder service implementation on the given vsock
@@ -44,7 +47,7 @@
F: FnOnce(),
{
fn run_server(&mut self, mut service: SpIBinder, port: u32) -> bool {
- let service = service.as_native_mut() as *mut binder_rpc_unstable_bindgen::AIBinder;
+ let service = service.as_native_mut();
let param = self.as_void_ptr();
// SAFETY: Service ownership is transferring to the server and won't be valid afterward.
@@ -106,10 +109,7 @@
}
}
-unsafe extern "C" fn factory_wrapper(
- cid: u32,
- context: *mut raw::c_void,
-) -> *mut binder_rpc_unstable_bindgen::AIBinder {
+unsafe extern "C" fn factory_wrapper(cid: u32, context: *mut raw::c_void) -> *mut AIBinder {
// SAFETY: `context` was created from an `&mut RpcServerFactoryRef` by
// `run_rpc_server_with_factory`, and we are still within the lifetime of the value it is
// pointing to.
@@ -117,7 +117,7 @@
let factory = factory_ptr.as_mut().unwrap();
if let Some(mut service) = factory(cid) {
- service.as_native_mut() as *mut binder_rpc_unstable_bindgen::AIBinder
+ service.as_native_mut()
} else {
null_mut()
}
diff --git a/libs/binder/rust/src/native.rs b/libs/binder/rust/src/native.rs
index 3a6dadd..dee05d0 100644
--- a/libs/binder/rust/src/native.rs
+++ b/libs/binder/rust/src/native.rs
@@ -296,7 +296,7 @@
/// Must be called with a valid pointer to a `T` object. After this call,
/// the pointer will be invalid and should not be dereferenced.
unsafe extern "C" fn on_destroy(object: *mut c_void) {
- Box::from_raw(object as *mut T);
+ drop(Box::from_raw(object as *mut T));
}
/// Called whenever a new, local `AIBinder` object is needed of a specific
diff --git a/opengl/libs/Android.bp b/opengl/libs/Android.bp
index c1e935a..2237d2d 100644
--- a/opengl/libs/Android.bp
+++ b/opengl/libs/Android.bp
@@ -170,7 +170,11 @@
"libEGL_getProcAddress",
"libEGL_blobCache",
],
- ldflags: ["-Wl,--exclude-libs=ALL,--Bsymbolic-functions"],
+ ldflags: [
+ "-Wl,--exclude-libs=libEGL_getProcAddress.a",
+ "-Wl,--exclude-libs=libEGL_blobCache.a",
+ "-Wl,--Bsymbolic-functions",
+ ],
export_include_dirs: ["EGL/include"],
stubs: {
symbol_file: "libEGL.map.txt",