commit b0221d1a8ee6d634b238361188c938e339d6083a
author Frederick Mayle <fmayle@google.com> Mon Oct 03 23:10:53 2022 +0000
committer Frederick Mayle <fmayle@google.com> Wed Oct 05 00:37:35 2022 +0000
tree cc3e1780e35bce3dbdf4c776c89e4f881adebd0f
parent 12b528b0527b1a60569d8c2ec0976659d56f3c60

libbinder: Fix FD handling for queued oneway RPC transactions

If a oneway transaction contained FDs and got queued, we'd drop the FDs
and then the Parcel validation would fail with an error once the
transaction was eventually processed.

Bug: 244484370
Test: m libbinder binderRpcTest && out/host/linux-x86/nativetest64/binderRpcTest/binderRpcTest
Change-Id: I781d851d875d496c8b57e3512f3f89c9911e9f3c

libs/binder/RpcState.cpp

diff --git a/libs/binder/RpcState.cpp b/libs/binder/RpcState.cpp
index c0e36c4..a964067 100644
--- a/libs/binder/RpcState.cpp
+++ b/libs/binder/RpcState.cpp
@@ -886,6 +886,7 @@
                 it->second.asyncTodo.push(BinderNode::AsyncTodo{
                         .ref = target,
                         .data = std::move(transactionData),
+                        .ancillaryFds = std::move(ancillaryFds),
                         .asyncNumber = transaction->asyncNumber,
                 });
 
@@ -1046,6 +1047,7 @@
 
                 // reset up arguments
                 transactionData = std::move(todo.data);
+                ancillaryFds = std::move(todo.ancillaryFds);
                 LOG_ALWAYS_FATAL_IF(target != todo.ref,
                                     "async list should be associated with a binder");