blob: 65c6553e443b727d4eaee6d705ea0434c4194761 [file] [log] [blame]
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "Parcel"
18//#define LOG_NDEBUG 0
19
Tomasz Wasilczyk1d1e9ff2023-10-25 16:17:54 -070020#include <endian.h>
Mark Salyzynabed7f72016-01-27 08:02:48 -080021#include <errno.h>
Mark Salyzyn70f36652016-02-02 10:27:03 -080022#include <fcntl.h>
Mark Salyzynabed7f72016-01-27 08:02:48 -080023#include <inttypes.h>
Mark Salyzyn70f36652016-02-02 10:27:03 -080024#include <pthread.h>
Mark Salyzynabed7f72016-01-27 08:02:48 -080025#include <stdint.h>
26#include <stdio.h>
27#include <stdlib.h>
28#include <sys/mman.h>
Andrei Homescua9cca9c2022-05-03 04:48:01 +000029#include <sys/resource.h>
Mark Salyzyneab2afc2016-01-27 08:02:48 -080030#include <sys/stat.h>
31#include <sys/types.h>
32#include <unistd.h>
Benjamin Lerman38f51272024-04-22 14:27:36 +020033#include <algorithm>
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070034
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070035#include <binder/Binder.h>
36#include <binder/BpBinder.h>
Tomasz Wasilczyk1de48a22023-10-30 14:19:19 +000037#include <binder/Functional.h>
Mark Salyzynabed7f72016-01-27 08:02:48 -080038#include <binder/IPCThreadState.h>
39#include <binder/Parcel.h>
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070040#include <binder/ProcessState.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070041#include <binder/Stability.h>
Christopher Wiley09eb7492015-11-09 15:06:15 -080042#include <binder/Status.h>
Mathias Agopian002e1e52013-05-06 20:20:50 -070043#include <binder/TextOutput.h>
44
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +000045#ifndef BINDER_DISABLE_BLOB
Mark Salyzynabed7f72016-01-27 08:02:48 -080046#include <cutils/ashmem.h>
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +000047#endif
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070048#include <utils/String16.h>
Steven Moreland3af936a2021-03-26 03:05:38 +000049#include <utils/String8.h>
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070050
Andrei Homescu24ad36e2022-08-04 01:33:33 +000051#include "OS.h"
Steven Moreland5553ac42020-11-11 02:14:45 +000052#include "RpcState.h"
Steven Morelanda4853cd2019-07-12 15:44:37 -070053#include "Static.h"
Steven Morelandf183fdd2020-10-27 00:12:12 +000054#include "Utils.h"
Andrei Homescua9cca9c2022-05-03 04:48:01 +000055
56// A lot of code in this file uses definitions from the
57// Linux kernel header for Binder <linux/android/binder.h>
58// which is included indirectly via "binder_module.h".
59// Non-Linux OSes do not have that header, so libbinder should be
60// built for those targets without kernel binder support, i.e.,
61// without BINDER_WITH_KERNEL_IPC. For this reason, all code in this
62// file that depends on kernel binder, including the header itself,
63// is conditional on BINDER_WITH_KERNEL_IPC.
64#ifdef BINDER_WITH_KERNEL_IPC
65#include <linux/sched.h>
Steven Moreland6ba5a252021-05-04 22:49:00 +000066#include "binder_module.h"
Andrei Homescua9cca9c2022-05-03 04:48:01 +000067#else // BINDER_WITH_KERNEL_IPC
68// Needed by {read,write}Pointer
69typedef uintptr_t binder_uintptr_t;
70#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070071
Steven Moreland02f736f2023-06-22 23:03:57 +000072#ifdef __BIONIC__
73#include <android/fdsan.h>
74#endif
75
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070076#define LOG_REFS(...)
Andrei Homescua9cca9c2022-05-03 04:48:01 +000077// #define LOG_REFS(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
Dianne Hackborn7e790af2014-11-11 12:22:53 -080078#define LOG_ALLOC(...)
Andrei Homescua9cca9c2022-05-03 04:48:01 +000079// #define LOG_ALLOC(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070080
81// ---------------------------------------------------------------------------
82
Nick Kralevichb6b14232015-04-02 09:36:02 -070083// This macro should never be used at runtime, as a too large value
84// of s could cause an integer overflow. Instead, you should always
85// use the wrapper function pad_size()
Andrei Homescuf7f2c172022-03-08 22:52:49 +000086#define PAD_SIZE_UNSAFE(s) (((s) + 3) & ~3UL)
Nick Kralevichb6b14232015-04-02 09:36:02 -070087
88static size_t pad_size(size_t s) {
Steven Moreland28723ae2019-04-01 18:52:30 -070089 if (s > (std::numeric_limits<size_t>::max() - 3)) {
Steven Moreland6adf33c2019-09-25 13:18:09 -070090 LOG_ALWAYS_FATAL("pad size too big %zu", s);
Nick Kralevichb6b14232015-04-02 09:36:02 -070091 }
92 return PAD_SIZE_UNSAFE(s);
93}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070094
Brad Fitzpatricka877cd82010-07-07 16:06:39 -070095// Note: must be kept in sync with android/os/StrictMode.java's PENALTY_GATHER
Jeff Sharkey05827be2018-06-26 10:52:38 -060096#define STRICT_MODE_PENALTY_GATHER (1 << 31)
Brad Fitzpatricka877cd82010-07-07 16:06:39 -070097
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -070098namespace android {
99
Tomasz Wasilczyk1de48a22023-10-30 14:19:19 +0000100using namespace android::binder::impl;
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -0700101using binder::borrowed_fd;
102using binder::unique_fd;
Tomasz Wasilczyk1de48a22023-10-30 14:19:19 +0000103
Steven Moreland7b102262019-08-01 15:48:43 -0700104// many things compile this into prebuilts on the stack
Steven Moreland90c1f9a2021-05-03 18:27:24 +0000105#ifdef __LP64__
106static_assert(sizeof(Parcel) == 120);
107#else
108static_assert(sizeof(Parcel) == 60);
109#endif
Steven Moreland7b102262019-08-01 15:48:43 -0700110
Jeff Sharkey8994c182020-09-11 12:07:10 -0600111static std::atomic<size_t> gParcelGlobalAllocCount;
112static std::atomic<size_t> gParcelGlobalAllocSize;
Dianne Hackborna4cff882014-11-13 17:07:40 -0800113
Andrei Homescu1519b982022-06-09 02:04:44 +0000114// Maximum number of file descriptors per Parcel.
115constexpr size_t kMaxFds = 1024;
Christopher Tatee4e0ae82016-03-24 16:03:44 -0700116
Jeff Brown13b16042014-11-11 16:44:25 -0800117// Maximum size of a blob to transfer in-place.
Tomasz Wasilczyk83780132023-11-29 21:39:29 -0800118[[maybe_unused]] static const size_t BLOB_INPLACE_LIMIT = 16 * 1024;
Jeff Brown13b16042014-11-11 16:44:25 -0800119
Steven Moreland02f736f2023-06-22 23:03:57 +0000120#if defined(__BIONIC__)
121static void FdTag(int fd, const void* old_addr, const void* new_addr) {
122 if (android_fdsan_exchange_owner_tag) {
123 uint64_t old_tag = android_fdsan_create_owner_tag(ANDROID_FDSAN_OWNER_TYPE_PARCEL,
124 reinterpret_cast<uint64_t>(old_addr));
125 uint64_t new_tag = android_fdsan_create_owner_tag(ANDROID_FDSAN_OWNER_TYPE_PARCEL,
126 reinterpret_cast<uint64_t>(new_addr));
127 android_fdsan_exchange_owner_tag(fd, old_tag, new_tag);
128 }
129}
130static void FdTagClose(int fd, const void* addr) {
131 if (android_fdsan_close_with_tag) {
132 uint64_t tag = android_fdsan_create_owner_tag(ANDROID_FDSAN_OWNER_TYPE_PARCEL,
133 reinterpret_cast<uint64_t>(addr));
134 android_fdsan_close_with_tag(fd, tag);
135 } else {
136 close(fd);
137 }
138}
139#else
140static void FdTag(int fd, const void* old_addr, const void* new_addr) {
141 (void)fd;
142 (void)old_addr;
143 (void)new_addr;
144}
145static void FdTagClose(int fd, const void* addr) {
146 (void)addr;
147 close(fd);
148}
149#endif
150
Jeff Brown13b16042014-11-11 16:44:25 -0800151enum {
152 BLOB_INPLACE = 0,
153 BLOB_ASHMEM_IMMUTABLE = 1,
154 BLOB_ASHMEM_MUTABLE = 2,
155};
156
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000157#ifdef BINDER_WITH_KERNEL_IPC
Steven Morelandc673f1f2021-10-07 18:23:35 -0700158static void acquire_object(const sp<ProcessState>& proc, const flat_binder_object& obj,
159 const void* who) {
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700160 switch (obj.hdr.type) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700161 case BINDER_TYPE_BINDER:
162 if (obj.binder) {
yuxic05af3b2021-08-24 02:52:15 +0000163 LOG_REFS("Parcel %p acquiring reference on local %llu", who, obj.cookie);
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -0800164 reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700165 }
166 return;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700167 case BINDER_TYPE_HANDLE: {
168 const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
Yi Kong91635562018-06-07 14:38:36 -0700169 if (b != nullptr) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700170 LOG_REFS("Parcel %p acquiring reference on remote %p", who, b.get());
171 b->incStrong(who);
172 }
173 return;
174 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700175 case BINDER_TYPE_FD: {
Steven Moreland02f736f2023-06-22 23:03:57 +0000176 if (obj.cookie != 0) { // owned
177 FdTag(obj.handle, nullptr, who);
178 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700179 return;
180 }
181 }
182
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700183 ALOGD("Invalid object type 0x%08x", obj.hdr.type);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700184}
185
Steven Morelandc673f1f2021-10-07 18:23:35 -0700186static void release_object(const sp<ProcessState>& proc, const flat_binder_object& obj,
187 const void* who) {
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700188 switch (obj.hdr.type) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700189 case BINDER_TYPE_BINDER:
190 if (obj.binder) {
yuxic05af3b2021-08-24 02:52:15 +0000191 LOG_REFS("Parcel %p releasing reference on local %llu", who, obj.cookie);
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -0800192 reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700193 }
194 return;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700195 case BINDER_TYPE_HANDLE: {
196 const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
Yi Kong91635562018-06-07 14:38:36 -0700197 if (b != nullptr) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700198 LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
199 b->decStrong(who);
200 }
201 return;
202 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700203 case BINDER_TYPE_FD: {
Steven Moreland02f736f2023-06-22 23:03:57 +0000204 // note: this path is not used when mOwner, so the tag is also released
205 // in 'closeFileDescriptors'
Mark Salyzynb454d8f2016-01-27 08:02:48 -0800206 if (obj.cookie != 0) { // owned
Steven Moreland02f736f2023-06-22 23:03:57 +0000207 FdTagClose(obj.handle, who);
Adrian Rooscbf37262015-10-22 16:12:53 -0700208 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700209 return;
210 }
211 }
212
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700213 ALOGE("Invalid object type 0x%08x", obj.hdr.type);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700214}
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000215#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700216
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -0700217static int toRawFd(const std::variant<unique_fd, borrowed_fd>& v) {
Frederick Mayle69a0c992022-05-26 20:38:39 +0000218 return std::visit([](const auto& fd) { return fd.get(); }, v);
219}
220
Frederick Mayled3c595a2022-05-09 23:02:54 +0000221Parcel::RpcFields::RpcFields(const sp<RpcSession>& session) : mSession(session) {
222 LOG_ALWAYS_FATAL_IF(mSession == nullptr);
223}
224
Steven Moreland34b48cb2020-12-01 22:45:38 +0000225status_t Parcel::finishFlattenBinder(const sp<IBinder>& binder)
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700226{
Steven Moreland6e5a7752019-08-05 20:30:14 -0700227 internal::Stability::tryMarkCompilationUnit(binder.get());
Steven Moreland16a41062021-07-23 13:35:25 -0700228 int16_t rep = internal::Stability::getRepr(binder.get());
Steven Moreland14e4cfa2021-06-03 21:40:45 +0000229 return writeInt32(rep);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700230}
231
Steven Morelanda86a3562019-08-01 23:28:34 +0000232status_t Parcel::finishUnflattenBinder(
233 const sp<IBinder>& binder, sp<IBinder>* out) const
234{
235 int32_t stability;
236 status_t status = readInt32(&stability);
237 if (status != OK) return status;
238
Steven Moreland14e4cfa2021-06-03 21:40:45 +0000239 status = internal::Stability::setRepr(binder.get(), static_cast<int16_t>(stability),
240 true /*log*/);
Steven Morelanda86a3562019-08-01 23:28:34 +0000241 if (status != OK) return status;
242
243 *out = binder;
244 return OK;
245}
246
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000247#ifdef BINDER_WITH_KERNEL_IPC
Steven Morelandbf1915b2020-07-16 22:43:02 +0000248static constexpr inline int schedPolicyMask(int policy, int priority) {
249 return (priority & FLAT_BINDER_FLAG_PRIORITY_MASK) | ((policy & 3) << FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT);
250}
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000251#endif // BINDER_WITH_KERNEL_IPC
Steven Morelandbf1915b2020-07-16 22:43:02 +0000252
Kalesh Singhd67c8e82020-12-29 15:46:25 -0500253status_t Parcel::flattenBinder(const sp<IBinder>& binder) {
254 BBinder* local = nullptr;
255 if (binder) local = binder->localBinder();
256 if (local) local->setParceled();
257
Frederick Mayled3c595a2022-05-09 23:02:54 +0000258 if (const auto* rpcFields = maybeRpcFields()) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000259 if (binder) {
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000260 status_t status = writeInt32(RpcFields::TYPE_BINDER); // non-null
Steven Moreland5553ac42020-11-11 02:14:45 +0000261 if (status != OK) return status;
Steven Moreland5623d1a2021-09-10 15:45:34 -0700262 uint64_t address;
Steven Morelanda5036f02021-06-08 02:26:57 +0000263 // TODO(b/167966510): need to undo this if the Parcel is not sent
Frederick Mayled3c595a2022-05-09 23:02:54 +0000264 status = rpcFields->mSession->state()->onBinderLeaving(rpcFields->mSession, binder,
265 &address);
Steven Moreland5553ac42020-11-11 02:14:45 +0000266 if (status != OK) return status;
Steven Moreland5623d1a2021-09-10 15:45:34 -0700267 status = writeUint64(address);
Steven Moreland5553ac42020-11-11 02:14:45 +0000268 if (status != OK) return status;
269 } else {
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000270 status_t status = writeInt32(RpcFields::TYPE_BINDER_NULL); // null
Steven Moreland5553ac42020-11-11 02:14:45 +0000271 if (status != OK) return status;
272 }
273 return finishFlattenBinder(binder);
274 }
275
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000276#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700277 flat_binder_object obj;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700278
Steven Morelandbf1915b2020-07-16 22:43:02 +0000279 int schedBits = 0;
280 if (!IPCThreadState::self()->backgroundSchedulingDisabled()) {
281 schedBits = schedPolicyMask(SCHED_NORMAL, 19);
Martijn Coenen2b631742017-05-05 11:16:59 -0700282 }
283
Yi Kong91635562018-06-07 14:38:36 -0700284 if (binder != nullptr) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700285 if (!local) {
286 BpBinder *proxy = binder->remoteBinder();
Yi Kong91635562018-06-07 14:38:36 -0700287 if (proxy == nullptr) {
Steve Blocke6f43dd2012-01-06 19:20:56 +0000288 ALOGE("null proxy");
Steven Moreland5553ac42020-11-11 02:14:45 +0000289 } else {
290 if (proxy->isRpcBinder()) {
Steven Morelanda9231112021-09-22 10:08:14 -0700291 ALOGE("Sending a socket binder over kernel binder is prohibited");
Steven Moreland5553ac42020-11-11 02:14:45 +0000292 return INVALID_OPERATION;
293 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700294 }
Steven Moreland99157622021-09-13 16:27:34 -0700295 const int32_t handle = proxy ? proxy->getPrivateAccessor().binderHandle() : 0;
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700296 obj.hdr.type = BINDER_TYPE_HANDLE;
Arve Hjønnevåg07fd0f12014-02-18 21:10:29 -0800297 obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
Steven Moreland49c27532022-03-01 10:21:07 +0000298 obj.flags = 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700299 obj.handle = handle;
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -0800300 obj.cookie = 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700301 } else {
Steven Morelandbf1915b2020-07-16 22:43:02 +0000302 int policy = local->getMinSchedulerPolicy();
303 int priority = local->getMinSchedulerPriority();
304
305 if (policy != 0 || priority != 0) {
306 // override value, since it is set explicitly
307 schedBits = schedPolicyMask(policy, priority);
308 }
Steven Moreland49c27532022-03-01 10:21:07 +0000309 obj.flags = FLAT_BINDER_FLAG_ACCEPTS_FDS;
Steven Morelandf0212002018-12-26 13:59:23 -0800310 if (local->isRequestingSid()) {
311 obj.flags |= FLAT_BINDER_FLAG_TXN_SECURITY_CTX;
312 }
Steven Morelandcf03cf12020-12-04 02:58:40 +0000313 if (local->isInheritRt()) {
314 obj.flags |= FLAT_BINDER_FLAG_INHERIT_RT;
315 }
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700316 obj.hdr.type = BINDER_TYPE_BINDER;
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -0800317 obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
318 obj.cookie = reinterpret_cast<uintptr_t>(local);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700319 }
320 } else {
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700321 obj.hdr.type = BINDER_TYPE_BINDER;
Steven Moreland49c27532022-03-01 10:21:07 +0000322 obj.flags = 0;
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -0800323 obj.binder = 0;
324 obj.cookie = 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700325 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700326
Steven Morelandbf1915b2020-07-16 22:43:02 +0000327 obj.flags |= schedBits;
328
Steven Moreland34b48cb2020-12-01 22:45:38 +0000329 status_t status = writeObject(obj, false);
330 if (status != OK) return status;
331
332 return finishFlattenBinder(binder);
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000333#else // BINDER_WITH_KERNEL_IPC
334 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
335 return INVALID_OPERATION;
336#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700337}
338
Steven Morelanda86a3562019-08-01 23:28:34 +0000339status_t Parcel::unflattenBinder(sp<IBinder>* out) const
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700340{
Frederick Mayled3c595a2022-05-09 23:02:54 +0000341 if (const auto* rpcFields = maybeRpcFields()) {
Steven Moreland5623d1a2021-09-10 15:45:34 -0700342 int32_t isPresent;
343 status_t status = readInt32(&isPresent);
Steven Moreland5553ac42020-11-11 02:14:45 +0000344 if (status != OK) return status;
345
346 sp<IBinder> binder;
347
Steven Moreland5623d1a2021-09-10 15:45:34 -0700348 if (isPresent & 1) {
349 uint64_t addr;
350 if (status_t status = readUint64(&addr); status != OK) return status;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000351 if (status_t status =
352 rpcFields->mSession->state()->onBinderEntering(rpcFields->mSession, addr,
353 &binder);
Steven Moreland7227c8a2021-06-02 00:24:32 +0000354 status != OK)
355 return status;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000356 if (status_t status =
357 rpcFields->mSession->state()->flushExcessBinderRefs(rpcFields->mSession,
358 addr, binder);
Steven Morelandd8083312021-09-22 13:37:10 -0700359 status != OK)
360 return status;
Steven Moreland5553ac42020-11-11 02:14:45 +0000361 }
362
363 return finishUnflattenBinder(binder, out);
364 }
365
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000366#ifdef BINDER_WITH_KERNEL_IPC
Steven Morelanda86a3562019-08-01 23:28:34 +0000367 const flat_binder_object* flat = readObject(false);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700368
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700369 if (flat) {
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -0700370 switch (flat->hdr.type) {
Steven Morelanda86a3562019-08-01 23:28:34 +0000371 case BINDER_TYPE_BINDER: {
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000372 sp<IBinder> binder =
373 sp<IBinder>::fromExisting(reinterpret_cast<IBinder*>(flat->cookie));
Steven Morelanda86a3562019-08-01 23:28:34 +0000374 return finishUnflattenBinder(binder, out);
375 }
376 case BINDER_TYPE_HANDLE: {
377 sp<IBinder> binder =
378 ProcessState::self()->getStrongProxyForHandle(flat->handle);
379 return finishUnflattenBinder(binder, out);
380 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700381 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700382 }
383 return BAD_TYPE;
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000384#else // BINDER_WITH_KERNEL_IPC
385 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
386 return INVALID_OPERATION;
387#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700388}
389
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700390// ---------------------------------------------------------------------------
391
392Parcel::Parcel()
393{
Dianne Hackborn7e790af2014-11-11 12:22:53 -0800394 LOG_ALLOC("Parcel %p: constructing", this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700395 initState();
396}
397
398Parcel::~Parcel()
399{
400 freeDataNoInit();
Dianne Hackborn7e790af2014-11-11 12:22:53 -0800401 LOG_ALLOC("Parcel %p: destroyed", this);
402}
403
404size_t Parcel::getGlobalAllocSize() {
Jeff Sharkey8994c182020-09-11 12:07:10 -0600405 return gParcelGlobalAllocSize.load();
Dianne Hackborn7e790af2014-11-11 12:22:53 -0800406}
407
408size_t Parcel::getGlobalAllocCount() {
Jeff Sharkey8994c182020-09-11 12:07:10 -0600409 return gParcelGlobalAllocCount.load();
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700410}
411
412const uint8_t* Parcel::data() const
413{
414 return mData;
415}
416
417size_t Parcel::dataSize() const
418{
419 return (mDataSize > mDataPos ? mDataSize : mDataPos);
420}
421
Pawan Waghd886a442023-01-21 02:16:38 +0000422size_t Parcel::dataBufferSize() const {
423 return mDataSize;
424}
425
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700426size_t Parcel::dataAvail() const
427{
Nick Kralevichcfe27de2015-09-16 09:49:15 -0700428 size_t result = dataSize() - dataPosition();
429 if (result > INT32_MAX) {
Steven Moreland6adf33c2019-09-25 13:18:09 -0700430 LOG_ALWAYS_FATAL("result too big: %zu", result);
Nick Kralevichcfe27de2015-09-16 09:49:15 -0700431 }
432 return result;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700433}
434
435size_t Parcel::dataPosition() const
436{
437 return mDataPos;
438}
439
440size_t Parcel::dataCapacity() const
441{
442 return mDataCapacity;
443}
444
445status_t Parcel::setDataSize(size_t size)
446{
Nick Kralevichb6b14232015-04-02 09:36:02 -0700447 if (size > INT32_MAX) {
448 // don't accept size_t values which may have come from an
449 // inadvertent conversion from a negative int.
450 return BAD_VALUE;
451 }
452
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700453 status_t err;
454 err = continueWrite(size);
455 if (err == NO_ERROR) {
456 mDataSize = size;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700457 ALOGV("setDataSize Setting data size of %p to %zu", this, mDataSize);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700458 }
459 return err;
460}
461
462void Parcel::setDataPosition(size_t pos) const
463{
Nick Kralevichb6b14232015-04-02 09:36:02 -0700464 if (pos > INT32_MAX) {
465 // don't accept size_t values which may have come from an
466 // inadvertent conversion from a negative int.
Steven Moreland6adf33c2019-09-25 13:18:09 -0700467 LOG_ALWAYS_FATAL("pos too big: %zu", pos);
Nick Kralevichb6b14232015-04-02 09:36:02 -0700468 }
469
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700470 mDataPos = pos;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000471 if (const auto* kernelFields = maybeKernelFields()) {
472 kernelFields->mNextObjectHint = 0;
473 kernelFields->mObjectsSorted = false;
474 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700475}
476
477status_t Parcel::setDataCapacity(size_t size)
478{
Nick Kralevichb6b14232015-04-02 09:36:02 -0700479 if (size > INT32_MAX) {
480 // don't accept size_t values which may have come from an
481 // inadvertent conversion from a negative int.
482 return BAD_VALUE;
483 }
484
Dianne Hackborn97e2bcd2011-04-13 18:15:56 -0700485 if (size > mDataCapacity) return continueWrite(size);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700486 return NO_ERROR;
487}
488
489status_t Parcel::setData(const uint8_t* buffer, size_t len)
490{
Nick Kralevichb6b14232015-04-02 09:36:02 -0700491 if (len > INT32_MAX) {
492 // don't accept size_t values which may have come from an
493 // inadvertent conversion from a negative int.
494 return BAD_VALUE;
495 }
496
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700497 status_t err = restartWrite(len);
498 if (err == NO_ERROR) {
499 memcpy(const_cast<uint8_t*>(data()), buffer, len);
500 mDataSize = len;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000501 if (auto* kernelFields = maybeKernelFields()) {
502 kernelFields->mFdsKnown = false;
503 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700504 }
505 return err;
506}
507
Frederick Mayled3c595a2022-05-09 23:02:54 +0000508status_t Parcel::appendFrom(const Parcel* parcel, size_t offset, size_t len) {
509 if (isForRpc() != parcel->isForRpc()) {
Steven Moreland2034eff2021-10-13 11:24:35 -0700510 ALOGE("Cannot append Parcel from one context to another. They may be different formats, "
511 "and objects are specific to a context.");
Steven Moreland67753c32021-04-02 18:45:19 +0000512 return BAD_TYPE;
513 }
Frederick Mayled3c595a2022-05-09 23:02:54 +0000514 if (isForRpc() && maybeRpcFields()->mSession != parcel->maybeRpcFields()->mSession) {
515 ALOGE("Cannot append Parcels from different sessions");
516 return BAD_TYPE;
517 }
Steven Moreland67753c32021-04-02 18:45:19 +0000518
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700519 status_t err;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000520 const uint8_t* data = parcel->mData;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700521 int startPos = mDataPos;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700522
523 if (len == 0) {
524 return NO_ERROR;
525 }
526
Nick Kralevichb6b14232015-04-02 09:36:02 -0700527 if (len > INT32_MAX) {
528 // don't accept size_t values which may have come from an
529 // inadvertent conversion from a negative int.
530 return BAD_VALUE;
531 }
532
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700533 // range checks against the source parcel size
534 if ((offset > parcel->mDataSize)
535 || (len > parcel->mDataSize)
536 || (offset + len > parcel->mDataSize)) {
537 return BAD_VALUE;
538 }
539
Dianne Hackborn97e2bcd2011-04-13 18:15:56 -0700540 if ((mDataSize+len) > mDataCapacity) {
541 // grow data
542 err = growData(len);
543 if (err != NO_ERROR) {
544 return err;
545 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700546 }
547
548 // append data
549 memcpy(mData + mDataPos, data + offset, len);
550 mDataPos += len;
551 mDataSize += len;
552
Dianne Hackborn8938ed22011-09-28 23:19:47 -0400553 err = NO_ERROR;
554
Frederick Mayled3c595a2022-05-09 23:02:54 +0000555 if (auto* kernelFields = maybeKernelFields()) {
Andrei Homescu88012462022-07-07 04:30:05 +0000556#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayled3c595a2022-05-09 23:02:54 +0000557 auto* otherKernelFields = parcel->maybeKernelFields();
558 LOG_ALWAYS_FATAL_IF(otherKernelFields == nullptr);
559
560 const binder_size_t* objects = otherKernelFields->mObjects;
561 size_t size = otherKernelFields->mObjectsSize;
562 // Count objects in range
563 int firstIndex = -1, lastIndex = -2;
564 for (int i = 0; i < (int)size; i++) {
565 size_t off = objects[i];
566 if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
567 if (firstIndex == -1) {
568 firstIndex = i;
569 }
570 lastIndex = i;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700571 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700572 }
Frederick Mayled3c595a2022-05-09 23:02:54 +0000573 int numObjects = lastIndex - firstIndex + 1;
574 if (numObjects > 0) {
575 const sp<ProcessState> proc(ProcessState::self());
576 // grow objects
577 if (kernelFields->mObjectsCapacity < kernelFields->mObjectsSize + numObjects) {
578 if ((size_t)numObjects > SIZE_MAX - kernelFields->mObjectsSize)
579 return NO_MEMORY; // overflow
580 if (kernelFields->mObjectsSize + numObjects > SIZE_MAX / 3)
581 return NO_MEMORY; // overflow
582 size_t newSize = ((kernelFields->mObjectsSize + numObjects) * 3) / 2;
583 if (newSize > SIZE_MAX / sizeof(binder_size_t)) return NO_MEMORY; // overflow
584 binder_size_t* objects = (binder_size_t*)realloc(kernelFields->mObjects,
585 newSize * sizeof(binder_size_t));
586 if (objects == (binder_size_t*)nullptr) {
587 return NO_MEMORY;
588 }
589 kernelFields->mObjects = objects;
590 kernelFields->mObjectsCapacity = newSize;
591 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700592
Frederick Mayled3c595a2022-05-09 23:02:54 +0000593 // append and acquire objects
594 int idx = kernelFields->mObjectsSize;
595 for (int i = firstIndex; i <= lastIndex; i++) {
596 size_t off = objects[i] - offset + startPos;
597 kernelFields->mObjects[idx++] = off;
598 kernelFields->mObjectsSize++;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700599
Frederick Mayled3c595a2022-05-09 23:02:54 +0000600 flat_binder_object* flat = reinterpret_cast<flat_binder_object*>(mData + off);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700601
Frederick Mayled3c595a2022-05-09 23:02:54 +0000602 if (flat->hdr.type == BINDER_TYPE_FD) {
603 // If this is a file descriptor, we need to dup it so the
604 // new Parcel now owns its own fd, and can declare that we
605 // officially know we have fds.
606 flat->handle = fcntl(flat->handle, F_DUPFD_CLOEXEC, 0);
607 flat->cookie = 1;
608 kernelFields->mHasFds = kernelFields->mFdsKnown = true;
609 if (!mAllowFds) {
610 err = FDS_NOT_ALLOWED;
611 }
Dianne Hackborn8938ed22011-09-28 23:19:47 -0400612 }
Steven Moreland02f736f2023-06-22 23:03:57 +0000613
614 acquire_object(proc, *flat, this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700615 }
616 }
Andrei Homescu88012462022-07-07 04:30:05 +0000617#else
618 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +0000619 (void)kernelFields;
Andrei Homescu88012462022-07-07 04:30:05 +0000620 return INVALID_OPERATION;
621#endif // BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +0000622 } else {
623 auto* rpcFields = maybeRpcFields();
624 LOG_ALWAYS_FATAL_IF(rpcFields == nullptr);
625 auto* otherRpcFields = parcel->maybeRpcFields();
626 if (otherRpcFields == nullptr) {
627 return BAD_TYPE;
628 }
629 if (rpcFields->mSession != otherRpcFields->mSession) {
630 return BAD_TYPE;
631 }
632
633 const size_t savedDataPos = mDataPos;
Tomasz Wasilczyk1de48a22023-10-30 14:19:19 +0000634 auto scopeGuard = make_scope_guard([&]() { mDataPos = savedDataPos; });
Frederick Mayle69a0c992022-05-26 20:38:39 +0000635
636 rpcFields->mObjectPositions.reserve(otherRpcFields->mObjectPositions.size());
637 if (otherRpcFields->mFds != nullptr) {
638 if (rpcFields->mFds == nullptr) {
639 rpcFields->mFds = std::make_unique<decltype(rpcFields->mFds)::element_type>();
640 }
641 rpcFields->mFds->reserve(otherRpcFields->mFds->size());
642 }
643 for (size_t i = 0; i < otherRpcFields->mObjectPositions.size(); i++) {
644 const binder_size_t objPos = otherRpcFields->mObjectPositions[i];
645 if (offset <= objPos && objPos < offset + len) {
646 size_t newDataPos = objPos - offset + startPos;
647 rpcFields->mObjectPositions.push_back(newDataPos);
648
649 mDataPos = newDataPos;
650 int32_t objectType;
651 if (status_t status = readInt32(&objectType); status != OK) {
652 return status;
653 }
654 if (objectType != RpcFields::TYPE_NATIVE_FILE_DESCRIPTOR) {
655 continue;
656 }
657
658 if (!mAllowFds) {
659 return FDS_NOT_ALLOWED;
660 }
661
662 // Read FD, duplicate, and add to list.
663 int32_t fdIndex;
664 if (status_t status = readInt32(&fdIndex); status != OK) {
665 return status;
666 }
Andrei Homescufc221502022-10-08 03:51:17 +0000667 int oldFd = toRawFd(otherRpcFields->mFds->at(fdIndex));
Frederick Mayle69a0c992022-05-26 20:38:39 +0000668 // To match kernel binder behavior, we always dup, even if the
669 // FD was unowned in the source parcel.
Andrei Homescufc221502022-10-08 03:51:17 +0000670 int newFd = -1;
Tomasz Wasilczyk0d9dec22023-10-06 20:28:49 +0000671 if (status_t status = binder::os::dupFileDescriptor(oldFd, &newFd); status != OK) {
Steven Morelandc4fe2462024-10-22 00:01:25 +0000672 ALOGW("Failed to duplicate file descriptor %d: %s", oldFd,
673 statusToString(status).c_str());
Andrei Homescufc221502022-10-08 03:51:17 +0000674 }
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -0700675 rpcFields->mFds->emplace_back(unique_fd(newFd));
Frederick Mayle69a0c992022-05-26 20:38:39 +0000676 // Fixup the index in the data.
677 mDataPos = newDataPos + 4;
678 if (status_t status = writeInt32(rpcFields->mFds->size() - 1); status != OK) {
679 return status;
680 }
681 }
682 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700683 }
684
Dianne Hackborn8938ed22011-09-28 23:19:47 -0400685 return err;
686}
687
Steven Morelande96c2b42024-09-30 23:30:28 +0000688int Parcel::compareData(const Parcel& other) const {
Dianne Hackborn15feb9b2017-04-10 15:34:35 -0700689 size_t size = dataSize();
690 if (size != other.dataSize()) {
691 return size < other.dataSize() ? -1 : 1;
692 }
693 return memcmp(data(), other.data(), size);
694}
695
Bernardo Rufino897b1652021-10-08 10:30:20 +0100696status_t Parcel::compareDataInRange(size_t thisOffset, const Parcel& other, size_t otherOffset,
697 size_t len, int* result) const {
698 if (len > INT32_MAX || thisOffset > INT32_MAX || otherOffset > INT32_MAX) {
699 // Don't accept size_t values which may have come from an inadvertent conversion from a
700 // negative int.
701 return BAD_VALUE;
702 }
703 size_t thisLimit;
704 if (__builtin_add_overflow(thisOffset, len, &thisLimit) || thisLimit > mDataSize) {
705 return BAD_VALUE;
706 }
707 size_t otherLimit;
708 if (__builtin_add_overflow(otherOffset, len, &otherLimit) || otherLimit > other.mDataSize) {
709 return BAD_VALUE;
710 }
711 *result = memcmp(data() + thisOffset, other.data() + otherOffset, len);
712 return NO_ERROR;
713}
714
Jeff Brown13b16042014-11-11 16:44:25 -0800715bool Parcel::allowFds() const
716{
717 return mAllowFds;
718}
719
Dianne Hackborn7746cc32011-10-03 21:09:35 -0700720bool Parcel::pushAllowFds(bool allowFds)
Dianne Hackborn8938ed22011-09-28 23:19:47 -0400721{
722 const bool origValue = mAllowFds;
Dianne Hackborn7746cc32011-10-03 21:09:35 -0700723 if (!allowFds) {
724 mAllowFds = false;
725 }
Dianne Hackborn8938ed22011-09-28 23:19:47 -0400726 return origValue;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700727}
728
Dianne Hackborn7746cc32011-10-03 21:09:35 -0700729void Parcel::restoreAllowFds(bool lastValue)
730{
731 mAllowFds = lastValue;
732}
733
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700734bool Parcel::hasFileDescriptors() const
735{
Frederick Mayled3c595a2022-05-09 23:02:54 +0000736 if (const auto* rpcFields = maybeRpcFields()) {
Frederick Mayle69a0c992022-05-26 20:38:39 +0000737 return rpcFields->mFds != nullptr && !rpcFields->mFds->empty();
Frederick Mayled3c595a2022-05-09 23:02:54 +0000738 }
739 auto* kernelFields = maybeKernelFields();
740 if (!kernelFields->mFdsKnown) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700741 scanForFds();
742 }
Frederick Mayled3c595a2022-05-09 23:02:54 +0000743 return kernelFields->mHasFds;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700744}
745
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000746status_t Parcel::hasBinders(bool* result) const {
747 status_t status = hasBindersInRange(0, dataSize(), result);
748 ALOGE_IF(status != NO_ERROR, "Error %d calling hasBindersInRange()", status);
749 return status;
750}
751
Steven Moreland4b2f18d2022-03-24 00:32:25 +0000752std::vector<sp<IBinder>> Parcel::debugReadAllStrongBinders() const {
753 std::vector<sp<IBinder>> ret;
754
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000755#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayled3c595a2022-05-09 23:02:54 +0000756 const auto* kernelFields = maybeKernelFields();
757 if (kernelFields == nullptr) {
758 return ret;
759 }
760
Steven Moreland4b2f18d2022-03-24 00:32:25 +0000761 size_t initPosition = dataPosition();
Frederick Mayled3c595a2022-05-09 23:02:54 +0000762 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
763 binder_size_t offset = kernelFields->mObjects[i];
Steven Moreland4b2f18d2022-03-24 00:32:25 +0000764 const flat_binder_object* flat =
765 reinterpret_cast<const flat_binder_object*>(mData + offset);
766 if (flat->hdr.type != BINDER_TYPE_BINDER) continue;
767
768 setDataPosition(offset);
769
770 sp<IBinder> binder = readStrongBinder();
771 if (binder != nullptr) ret.push_back(binder);
772 }
773
774 setDataPosition(initPosition);
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000775#endif // BINDER_WITH_KERNEL_IPC
776
Steven Moreland4b2f18d2022-03-24 00:32:25 +0000777 return ret;
778}
779
780std::vector<int> Parcel::debugReadAllFileDescriptors() const {
781 std::vector<int> ret;
782
Frederick Mayle69a0c992022-05-26 20:38:39 +0000783 if (const auto* kernelFields = maybeKernelFields()) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000784#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +0000785 size_t initPosition = dataPosition();
786 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
787 binder_size_t offset = kernelFields->mObjects[i];
788 const flat_binder_object* flat =
789 reinterpret_cast<const flat_binder_object*>(mData + offset);
790 if (flat->hdr.type != BINDER_TYPE_FD) continue;
791
792 setDataPosition(offset);
793
794 int fd = readFileDescriptor();
795 LOG_ALWAYS_FATAL_IF(fd == -1);
796 ret.push_back(fd);
797 }
798 setDataPosition(initPosition);
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000799#else
800 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +0000801 (void)kernelFields;
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000802#endif
Frederick Mayle69a0c992022-05-26 20:38:39 +0000803 } else if (const auto* rpcFields = maybeRpcFields(); rpcFields && rpcFields->mFds) {
804 for (const auto& fd : *rpcFields->mFds) {
805 ret.push_back(toRawFd(fd));
806 }
Frederick Mayled3c595a2022-05-09 23:02:54 +0000807 }
808
Steven Moreland4b2f18d2022-03-24 00:32:25 +0000809 return ret;
810}
811
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000812status_t Parcel::hasBindersInRange(size_t offset, size_t len, bool* result) const {
813 if (len > INT32_MAX || offset > INT32_MAX) {
814 // Don't accept size_t values which may have come from an inadvertent conversion from a
815 // negative int.
816 return BAD_VALUE;
817 }
818 size_t limit;
819 if (__builtin_add_overflow(offset, len, &limit) || limit > mDataSize) {
820 return BAD_VALUE;
821 }
822 *result = false;
823 if (const auto* kernelFields = maybeKernelFields()) {
824#ifdef BINDER_WITH_KERNEL_IPC
825 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
826 size_t pos = kernelFields->mObjects[i];
827 if (pos < offset) continue;
828 if (pos + sizeof(flat_binder_object) > offset + len) {
829 if (kernelFields->mObjectsSorted) {
830 break;
831 } else {
832 continue;
833 }
834 }
835 const flat_binder_object* flat =
836 reinterpret_cast<const flat_binder_object*>(mData + pos);
837 if (flat->hdr.type == BINDER_TYPE_BINDER || flat->hdr.type == BINDER_TYPE_HANDLE) {
838 *result = true;
839 break;
840 }
841 }
842#else
843 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +0000844 (void)kernelFields;
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000845 return INVALID_OPERATION;
846#endif // BINDER_WITH_KERNEL_IPC
Per Larsen202895c2025-01-15 03:11:20 +0000847 } else if (maybeRpcFields()) {
sandeepbandaruaa9d3a32024-02-22 17:16:53 +0000848 return INVALID_OPERATION;
849 }
850 return NO_ERROR;
851}
852
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +0100853status_t Parcel::hasFileDescriptorsInRange(size_t offset, size_t len, bool* result) const {
Bernardo Rufino22092af2021-10-07 14:09:24 +0100854 if (len > INT32_MAX || offset > INT32_MAX) {
855 // Don't accept size_t values which may have come from an inadvertent conversion from a
856 // negative int.
857 return BAD_VALUE;
858 }
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +0100859 size_t limit;
860 if (__builtin_add_overflow(offset, len, &limit) || limit > mDataSize) {
Bernardo Rufino22092af2021-10-07 14:09:24 +0100861 return BAD_VALUE;
862 }
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +0100863 *result = false;
Frederick Mayle69a0c992022-05-26 20:38:39 +0000864 if (const auto* kernelFields = maybeKernelFields()) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000865#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +0000866 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
867 size_t pos = kernelFields->mObjects[i];
868 if (pos < offset) continue;
869 if (pos + sizeof(flat_binder_object) > offset + len) {
870 if (kernelFields->mObjectsSorted) {
871 break;
872 } else {
873 continue;
874 }
875 }
876 const flat_binder_object* flat =
877 reinterpret_cast<const flat_binder_object*>(mData + pos);
878 if (flat->hdr.type == BINDER_TYPE_FD) {
879 *result = true;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000880 break;
Frederick Mayled3c595a2022-05-09 23:02:54 +0000881 }
Bernardo Rufino22092af2021-10-07 14:09:24 +0100882 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000883#else
884 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +0000885 (void)kernelFields;
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000886 return INVALID_OPERATION;
887#endif // BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +0000888 } else if (const auto* rpcFields = maybeRpcFields()) {
889 for (uint32_t pos : rpcFields->mObjectPositions) {
890 if (offset <= pos && pos < limit) {
891 const auto* type = reinterpret_cast<const RpcFields::ObjectType*>(mData + pos);
892 if (*type == RpcFields::TYPE_NATIVE_FILE_DESCRIPTOR) {
893 *result = true;
894 break;
895 }
896 }
Bernardo Rufino22092af2021-10-07 14:09:24 +0100897 }
898 }
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +0100899 return NO_ERROR;
Bernardo Rufino22092af2021-10-07 14:09:24 +0100900}
901
Steven Morelandf183fdd2020-10-27 00:12:12 +0000902void Parcel::markSensitive() const
903{
904 mDeallocZero = true;
905}
906
Steven Moreland5553ac42020-11-11 02:14:45 +0000907void Parcel::markForBinder(const sp<IBinder>& binder) {
Steven Moreland1fda67b2021-04-02 18:35:50 +0000908 LOG_ALWAYS_FATAL_IF(mData != nullptr, "format must be set before data is written");
909
Steven Moreland5553ac42020-11-11 02:14:45 +0000910 if (binder && binder->remoteBinder() && binder->remoteBinder()->isRpcBinder()) {
Steven Moreland99157622021-09-13 16:27:34 -0700911 markForRpc(binder->remoteBinder()->getPrivateAccessor().rpcSession());
Steven Moreland5553ac42020-11-11 02:14:45 +0000912 }
913}
914
Steven Morelandc9939062021-05-05 17:57:41 +0000915void Parcel::markForRpc(const sp<RpcSession>& session) {
Steven Moreland1fda67b2021-04-02 18:35:50 +0000916 LOG_ALWAYS_FATAL_IF(mData != nullptr && mOwner == nullptr,
917 "format must be set before data is written OR on IPC data");
918
Frederick Mayled3c595a2022-05-09 23:02:54 +0000919 mVariantFields.emplace<RpcFields>(session);
Steven Moreland5553ac42020-11-11 02:14:45 +0000920}
921
922bool Parcel::isForRpc() const {
Frederick Mayled3c595a2022-05-09 23:02:54 +0000923 return std::holds_alternative<RpcFields>(mVariantFields);
Steven Moreland5553ac42020-11-11 02:14:45 +0000924}
925
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000926void Parcel::updateWorkSourceRequestHeaderPosition() const {
Frederick Mayled3c595a2022-05-09 23:02:54 +0000927 auto* kernelFields = maybeKernelFields();
928 if (kernelFields == nullptr) {
929 return;
930 }
931
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000932 // Only update the request headers once. We only want to point
933 // to the first headers read/written.
Frederick Mayled3c595a2022-05-09 23:02:54 +0000934 if (!kernelFields->mRequestHeaderPresent) {
935 kernelFields->mWorkSourceRequestHeaderPosition = dataPosition();
936 kernelFields->mRequestHeaderPresent = true;
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000937 }
938}
939
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000940#ifdef BINDER_WITH_KERNEL_IPC
Steven Moreland94e63e12023-12-05 20:29:50 +0000941
942#if defined(__ANDROID__)
943
Steven Morelandb6c7e222021-02-18 19:20:14 +0000944#if defined(__ANDROID_VNDK__)
Steven Morelandd70160f2019-07-23 10:20:38 -0700945constexpr int32_t kHeader = B_PACK_CHARS('V', 'N', 'D', 'R');
Yifan Hong70786532021-10-20 21:41:18 -0700946#elif defined(__ANDROID_RECOVERY__)
947constexpr int32_t kHeader = B_PACK_CHARS('R', 'E', 'C', 'O');
Steven Morelandd70160f2019-07-23 10:20:38 -0700948#else
949constexpr int32_t kHeader = B_PACK_CHARS('S', 'Y', 'S', 'T');
950#endif
Steven Moreland94e63e12023-12-05 20:29:50 +0000951
952#else // ANDROID not defined
953
954// If kernel binder is used in new environments, we need to make sure it's separated
955// out and has a separate header.
956constexpr int32_t kHeader = B_PACK_CHARS('U', 'N', 'K', 'N');
957#endif
958
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000959#endif // BINDER_WITH_KERNEL_IPC
Steven Morelandd70160f2019-07-23 10:20:38 -0700960
Brad Fitzpatrick702ea9d2010-06-18 13:07:53 -0700961// Write RPC headers. (previously just the interface token)
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700962status_t Parcel::writeInterfaceToken(const String16& interface)
963{
Tomasz Wasilczyk0bfea2d2023-08-11 00:06:51 +0000964 return writeInterfaceToken(interface.c_str(), interface.size());
Steven Morelanddbc76c72020-10-01 18:02:48 +0000965}
966
967status_t Parcel::writeInterfaceToken(const char16_t* str, size_t len) {
Frederick Mayled3c595a2022-05-09 23:02:54 +0000968 if (auto* kernelFields = maybeKernelFields()) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000969#ifdef BINDER_WITH_KERNEL_IPC
Steven Moreland3af936a2021-03-26 03:05:38 +0000970 const IPCThreadState* threadState = IPCThreadState::self();
971 writeInt32(threadState->getStrictModePolicy() | STRICT_MODE_PENALTY_GATHER);
972 updateWorkSourceRequestHeaderPosition();
973 writeInt32(threadState->shouldPropagateWorkSource() ? threadState->getCallingWorkSourceUid()
974 : IPCThreadState::kUnsetWorkSource);
975 writeInt32(kHeader);
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000976#else // BINDER_WITH_KERNEL_IPC
977 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +0000978 (void)kernelFields;
Andrei Homescua9cca9c2022-05-03 04:48:01 +0000979 return INVALID_OPERATION;
980#endif // BINDER_WITH_KERNEL_IPC
Steven Moreland3af936a2021-03-26 03:05:38 +0000981 }
Steven Morelanddbc76c72020-10-01 18:02:48 +0000982
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700983 // currently the interface identification token is just its name as a string
Steven Morelanddbc76c72020-10-01 18:02:48 +0000984 return writeString16(str, len);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -0700985}
986
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000987bool Parcel::replaceCallingWorkSourceUid(uid_t uid)
988{
Frederick Mayled3c595a2022-05-09 23:02:54 +0000989 auto* kernelFields = maybeKernelFields();
990 if (kernelFields == nullptr) {
991 return false;
992 }
993 if (!kernelFields->mRequestHeaderPresent) {
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000994 return false;
995 }
996
997 const size_t initialPosition = dataPosition();
Frederick Mayled3c595a2022-05-09 23:02:54 +0000998 setDataPosition(kernelFields->mWorkSourceRequestHeaderPosition);
Olivier Gaillarddc848a02019-01-30 17:10:44 +0000999 status_t err = writeInt32(uid);
1000 setDataPosition(initialPosition);
1001 return err == NO_ERROR;
1002}
1003
Steven Morelandf1b1e492019-05-06 15:05:13 -07001004uid_t Parcel::readCallingWorkSourceUid() const
Olivier Gaillarddc848a02019-01-30 17:10:44 +00001005{
Frederick Mayled3c595a2022-05-09 23:02:54 +00001006 auto* kernelFields = maybeKernelFields();
1007 if (kernelFields == nullptr) {
1008 return false;
1009 }
1010 if (!kernelFields->mRequestHeaderPresent) {
Olivier Gaillarddc848a02019-01-30 17:10:44 +00001011 return IPCThreadState::kUnsetWorkSource;
1012 }
1013
1014 const size_t initialPosition = dataPosition();
Frederick Mayled3c595a2022-05-09 23:02:54 +00001015 setDataPosition(kernelFields->mWorkSourceRequestHeaderPosition);
Olivier Gaillarddc848a02019-01-30 17:10:44 +00001016 uid_t uid = readInt32();
1017 setDataPosition(initialPosition);
1018 return uid;
1019}
1020
Mathias Agopian83c04462009-05-22 19:00:22 -07001021bool Parcel::checkInterface(IBinder* binder) const
1022{
Brad Fitzpatrick702ea9d2010-06-18 13:07:53 -07001023 return enforceInterface(binder->getInterfaceDescriptor());
Mathias Agopian83c04462009-05-22 19:00:22 -07001024}
1025
Brad Fitzpatricka877cd82010-07-07 16:06:39 -07001026bool Parcel::enforceInterface(const String16& interface,
Brad Fitzpatrick70081a12010-07-27 09:49:11 -07001027 IPCThreadState* threadState) const
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001028{
Tomasz Wasilczyk0bfea2d2023-08-11 00:06:51 +00001029 return enforceInterface(interface.c_str(), interface.size(), threadState);
Daniel Colascione0bb330d2019-10-29 16:44:19 -07001030}
1031
1032bool Parcel::enforceInterface(const char16_t* interface,
1033 size_t len,
1034 IPCThreadState* threadState) const
1035{
Frederick Mayled3c595a2022-05-09 23:02:54 +00001036 if (auto* kernelFields = maybeKernelFields()) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001037#ifdef BINDER_WITH_KERNEL_IPC
Steven Moreland3af936a2021-03-26 03:05:38 +00001038 // StrictModePolicy.
1039 int32_t strictPolicy = readInt32();
1040 if (threadState == nullptr) {
1041 threadState = IPCThreadState::self();
1042 }
1043 if ((threadState->getLastTransactionBinderFlags() & IBinder::FLAG_ONEWAY) != 0) {
1044 // For one-way calls, the callee is running entirely
1045 // disconnected from the caller, so disable StrictMode entirely.
1046 // Not only does disk/network usage not impact the caller, but
1047 // there's no way to communicate back violations anyway.
1048 threadState->setStrictModePolicy(0);
1049 } else {
1050 threadState->setStrictModePolicy(strictPolicy);
1051 }
1052 // WorkSource.
1053 updateWorkSourceRequestHeaderPosition();
1054 int32_t workSource = readInt32();
1055 threadState->setCallingWorkSourceUidWithoutPropagation(workSource);
1056 // vendor header
1057 int32_t header = readInt32();
Steven Moreland3a667492023-06-02 21:41:39 +00001058
1059 // fuzzers skip this check, because it is for protecting the underlying ABI, but
1060 // we don't want it to reduce our coverage
1061 if (header != kHeader && !mServiceFuzzing) {
Steven Moreland3af936a2021-03-26 03:05:38 +00001062 ALOGE("Expecting header 0x%x but found 0x%x. Mixing copies of libbinder?", kHeader,
1063 header);
1064 return false;
1065 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001066#else // BINDER_WITH_KERNEL_IPC
1067 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
1068 (void)threadState;
Per Larsen202895c2025-01-15 03:11:20 +00001069 (void)kernelFields;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001070 return false;
1071#endif // BINDER_WITH_KERNEL_IPC
Brad Fitzpatricka877cd82010-07-07 16:06:39 -07001072 }
Steven Moreland3af936a2021-03-26 03:05:38 +00001073
Olivier Gaillard0e0f1de2018-08-16 14:04:09 +01001074 // Interface descriptor.
Daniel Colascione0bb330d2019-10-29 16:44:19 -07001075 size_t parcel_interface_len;
1076 const char16_t* parcel_interface = readString16Inplace(&parcel_interface_len);
1077 if (len == parcel_interface_len &&
1078 (!len || !memcmp(parcel_interface, interface, len * sizeof (char16_t)))) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001079 return true;
1080 } else {
Steven Morelande99d8822023-06-02 21:56:39 +00001081 if (mServiceFuzzing) {
1082 // ignore. Theoretically, this could cause a few false positives, because
1083 // people could assume things about getInterfaceDescriptor if they pass
1084 // this point, but it would be extremely fragile. It's more important that
1085 // we fuzz with the above things read from the Parcel.
1086 return true;
1087 } else {
Steven Moreland3a667492023-06-02 21:41:39 +00001088 ALOGW("**** enforceInterface() expected '%s' but read '%s'",
Tomasz Wasilczyk0bfea2d2023-08-11 00:06:51 +00001089 String8(interface, len).c_str(),
1090 String8(parcel_interface, parcel_interface_len).c_str());
Steven Morelande99d8822023-06-02 21:56:39 +00001091 return false;
Steven Moreland3a667492023-06-02 21:41:39 +00001092 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001093 }
Brad Fitzpatrick702ea9d2010-06-18 13:07:53 -07001094}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001095
Pawan Wagh104654a2022-11-15 21:18:42 +00001096void Parcel::setEnforceNoDataAvail(bool enforceNoDataAvail) {
1097 mEnforceNoDataAvail = enforceNoDataAvail;
1098}
1099
Steven Moreland3a667492023-06-02 21:41:39 +00001100void Parcel::setServiceFuzzing() {
1101 mServiceFuzzing = true;
1102}
1103
Steven Moreland418914a2023-06-28 21:47:14 +00001104bool Parcel::isServiceFuzzing() const {
1105 return mServiceFuzzing;
1106}
1107
Jooyung Hand23f9502021-12-23 14:39:57 +09001108binder::Status Parcel::enforceNoDataAvail() const {
Pawan Wagh104654a2022-11-15 21:18:42 +00001109 if (!mEnforceNoDataAvail) {
1110 return binder::Status::ok();
1111 }
1112
Jooyung Hand23f9502021-12-23 14:39:57 +09001113 const auto n = dataAvail();
1114 if (n == 0) {
1115 return binder::Status::ok();
1116 }
1117 return binder::Status::
1118 fromExceptionCode(binder::Status::Exception::EX_BAD_PARCELABLE,
1119 String8::format("Parcel data not fully consumed, unread size: %zu",
1120 n));
1121}
1122
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001123size_t Parcel::objectsCount() const
1124{
Frederick Mayled3c595a2022-05-09 23:02:54 +00001125 if (const auto* kernelFields = maybeKernelFields()) {
1126 return kernelFields->mObjectsSize;
1127 }
1128 return 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001129}
1130
1131status_t Parcel::errorCheck() const
1132{
1133 return mError;
1134}
1135
1136void Parcel::setError(status_t err)
1137{
1138 mError = err;
1139}
1140
1141status_t Parcel::finishWrite(size_t len)
1142{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001143 if (len > INT32_MAX) {
1144 // don't accept size_t values which may have come from an
1145 // inadvertent conversion from a negative int.
1146 return BAD_VALUE;
1147 }
1148
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001149 //printf("Finish write of %d\n", len);
1150 mDataPos += len;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001151 ALOGV("finishWrite Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001152 if (mDataPos > mDataSize) {
1153 mDataSize = mDataPos;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001154 ALOGV("finishWrite Setting data size of %p to %zu", this, mDataSize);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001155 }
1156 //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
1157 return NO_ERROR;
1158}
1159
1160status_t Parcel::writeUnpadded(const void* data, size_t len)
1161{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001162 if (len > INT32_MAX) {
1163 // don't accept size_t values which may have come from an
1164 // inadvertent conversion from a negative int.
1165 return BAD_VALUE;
1166 }
1167
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001168 size_t end = mDataPos + len;
1169 if (end < mDataPos) {
1170 // integer overflow
1171 return BAD_VALUE;
1172 }
1173
1174 if (end <= mDataCapacity) {
1175restart_write:
1176 memcpy(mData+mDataPos, data, len);
1177 return finishWrite(len);
1178 }
1179
1180 status_t err = growData(len);
1181 if (err == NO_ERROR) goto restart_write;
1182 return err;
1183}
1184
1185status_t Parcel::write(const void* data, size_t len)
1186{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001187 if (len > INT32_MAX) {
1188 // don't accept size_t values which may have come from an
1189 // inadvertent conversion from a negative int.
1190 return BAD_VALUE;
1191 }
1192
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001193 void* const d = writeInplace(len);
1194 if (d) {
1195 memcpy(d, data, len);
1196 return NO_ERROR;
1197 }
1198 return mError;
1199}
1200
1201void* Parcel::writeInplace(size_t len)
1202{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001203 if (len > INT32_MAX) {
1204 // don't accept size_t values which may have come from an
1205 // inadvertent conversion from a negative int.
Yi Kong91635562018-06-07 14:38:36 -07001206 return nullptr;
Nick Kralevichb6b14232015-04-02 09:36:02 -07001207 }
1208
1209 const size_t padded = pad_size(len);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001210
Khalid Ramadanb3d817b2021-11-18 07:02:50 +00001211 // check for integer overflow
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001212 if (mDataPos+padded < mDataPos) {
Yi Kong91635562018-06-07 14:38:36 -07001213 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001214 }
1215
1216 if ((mDataPos+padded) <= mDataCapacity) {
1217restart_write:
1218 //printf("Writing %ld bytes, padded to %ld\n", len, padded);
1219 uint8_t* const data = mData+mDataPos;
1220
1221 // Need to pad at end?
1222 if (padded != len) {
1223#if BYTE_ORDER == BIG_ENDIAN
1224 static const uint32_t mask[4] = {
1225 0x00000000, 0xffffff00, 0xffff0000, 0xff000000
1226 };
1227#endif
1228#if BYTE_ORDER == LITTLE_ENDIAN
1229 static const uint32_t mask[4] = {
1230 0x00000000, 0x00ffffff, 0x0000ffff, 0x000000ff
1231 };
1232#endif
1233 //printf("Applying pad mask: %p to %p\n", (void*)mask[padded-len],
1234 // *reinterpret_cast<void**>(data+padded-4));
1235 *reinterpret_cast<uint32_t*>(data+padded-4) &= mask[padded-len];
1236 }
1237
1238 finishWrite(padded);
1239 return data;
1240 }
1241
1242 status_t err = growData(padded);
1243 if (err == NO_ERROR) goto restart_write;
Yi Kong91635562018-06-07 14:38:36 -07001244 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001245}
1246
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001247status_t Parcel::writeUtf8AsUtf16(const std::string& str) {
1248 const uint8_t* strData = (uint8_t*)str.data();
1249 const size_t strLen= str.length();
1250 const ssize_t utf16Len = utf8_to_utf16_length(strData, strLen);
Sergio Girof4607432016-07-21 14:46:35 +01001251 if (utf16Len < 0 || utf16Len > std::numeric_limits<int32_t>::max()) {
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001252 return BAD_VALUE;
1253 }
1254
1255 status_t err = writeInt32(utf16Len);
1256 if (err) {
1257 return err;
1258 }
1259
1260 // Allocate enough bytes to hold our converted string and its terminating NULL.
1261 void* dst = writeInplace((utf16Len + 1) * sizeof(char16_t));
1262 if (!dst) {
1263 return NO_MEMORY;
1264 }
1265
Sergio Girof4607432016-07-21 14:46:35 +01001266 utf8_to_utf16(strData, strLen, (char16_t*)dst, (size_t) utf16Len + 1);
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001267
1268 return NO_ERROR;
1269}
1270
Jooyung Han9fcc4ef2020-01-23 12:45:10 +09001271
Andy Hung49198cf2020-11-18 11:02:39 -08001272status_t Parcel::writeUtf8AsUtf16(const std::optional<std::string>& str) { return writeData(str); }
1273status_t Parcel::writeUtf8AsUtf16(const std::unique_ptr<std::string>& str) { return writeData(str); }
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001274
Andy Hung49198cf2020-11-18 11:02:39 -08001275status_t Parcel::writeString16(const std::optional<String16>& str) { return writeData(str); }
1276status_t Parcel::writeString16(const std::unique_ptr<String16>& str) { return writeData(str); }
Casey Dahlin451ff582015-10-19 18:12:18 -07001277
Andy Hung49198cf2020-11-18 11:02:39 -08001278status_t Parcel::writeByteVector(const std::vector<int8_t>& val) { return writeData(val); }
1279status_t Parcel::writeByteVector(const std::optional<std::vector<int8_t>>& val) { return writeData(val); }
1280status_t Parcel::writeByteVector(const std::unique_ptr<std::vector<int8_t>>& val) { return writeData(val); }
1281status_t Parcel::writeByteVector(const std::vector<uint8_t>& val) { return writeData(val); }
1282status_t Parcel::writeByteVector(const std::optional<std::vector<uint8_t>>& val) { return writeData(val); }
1283status_t Parcel::writeByteVector(const std::unique_ptr<std::vector<uint8_t>>& val){ return writeData(val); }
1284status_t Parcel::writeInt32Vector(const std::vector<int32_t>& val) { return writeData(val); }
1285status_t Parcel::writeInt32Vector(const std::optional<std::vector<int32_t>>& val) { return writeData(val); }
1286status_t Parcel::writeInt32Vector(const std::unique_ptr<std::vector<int32_t>>& val) { return writeData(val); }
1287status_t Parcel::writeInt64Vector(const std::vector<int64_t>& val) { return writeData(val); }
1288status_t Parcel::writeInt64Vector(const std::optional<std::vector<int64_t>>& val) { return writeData(val); }
1289status_t Parcel::writeInt64Vector(const std::unique_ptr<std::vector<int64_t>>& val) { return writeData(val); }
1290status_t Parcel::writeUint64Vector(const std::vector<uint64_t>& val) { return writeData(val); }
1291status_t Parcel::writeUint64Vector(const std::optional<std::vector<uint64_t>>& val) { return writeData(val); }
1292status_t Parcel::writeUint64Vector(const std::unique_ptr<std::vector<uint64_t>>& val) { return writeData(val); }
1293status_t Parcel::writeFloatVector(const std::vector<float>& val) { return writeData(val); }
1294status_t Parcel::writeFloatVector(const std::optional<std::vector<float>>& val) { return writeData(val); }
1295status_t Parcel::writeFloatVector(const std::unique_ptr<std::vector<float>>& val) { return writeData(val); }
1296status_t Parcel::writeDoubleVector(const std::vector<double>& val) { return writeData(val); }
1297status_t Parcel::writeDoubleVector(const std::optional<std::vector<double>>& val) { return writeData(val); }
1298status_t Parcel::writeDoubleVector(const std::unique_ptr<std::vector<double>>& val) { return writeData(val); }
1299status_t Parcel::writeBoolVector(const std::vector<bool>& val) { return writeData(val); }
1300status_t Parcel::writeBoolVector(const std::optional<std::vector<bool>>& val) { return writeData(val); }
1301status_t Parcel::writeBoolVector(const std::unique_ptr<std::vector<bool>>& val) { return writeData(val); }
1302status_t Parcel::writeCharVector(const std::vector<char16_t>& val) { return writeData(val); }
1303status_t Parcel::writeCharVector(const std::optional<std::vector<char16_t>>& val) { return writeData(val); }
1304status_t Parcel::writeCharVector(const std::unique_ptr<std::vector<char16_t>>& val) { return writeData(val); }
Casey Dahlin451ff582015-10-19 18:12:18 -07001305
Andy Hung49198cf2020-11-18 11:02:39 -08001306status_t Parcel::writeString16Vector(const std::vector<String16>& val) { return writeData(val); }
Casey Dahlinb9872622015-11-25 15:09:45 -08001307status_t Parcel::writeString16Vector(
Andy Hung49198cf2020-11-18 11:02:39 -08001308 const std::optional<std::vector<std::optional<String16>>>& val) { return writeData(val); }
Jooyung Han9fcc4ef2020-01-23 12:45:10 +09001309status_t Parcel::writeString16Vector(
Andy Hung49198cf2020-11-18 11:02:39 -08001310 const std::unique_ptr<std::vector<std::unique_ptr<String16>>>& val) { return writeData(val); }
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001311status_t Parcel::writeUtf8VectorAsUtf16Vector(
Andy Hung49198cf2020-11-18 11:02:39 -08001312 const std::optional<std::vector<std::optional<std::string>>>& val) { return writeData(val); }
Jooyung Han9fcc4ef2020-01-23 12:45:10 +09001313status_t Parcel::writeUtf8VectorAsUtf16Vector(
Andy Hung49198cf2020-11-18 11:02:39 -08001314 const std::unique_ptr<std::vector<std::unique_ptr<std::string>>>& val) { return writeData(val); }
1315status_t Parcel::writeUtf8VectorAsUtf16Vector(const std::vector<std::string>& val) { return writeData(val); }
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001316
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001317status_t Parcel::writeUniqueFileDescriptorVector(const std::vector<unique_fd>& val) {
1318 return writeData(val);
1319}
1320status_t Parcel::writeUniqueFileDescriptorVector(const std::optional<std::vector<unique_fd>>& val) {
1321 return writeData(val);
1322}
Andy Hung49198cf2020-11-18 11:02:39 -08001323
1324status_t Parcel::writeStrongBinderVector(const std::vector<sp<IBinder>>& val) { return writeData(val); }
1325status_t Parcel::writeStrongBinderVector(const std::optional<std::vector<sp<IBinder>>>& val) { return writeData(val); }
1326status_t Parcel::writeStrongBinderVector(const std::unique_ptr<std::vector<sp<IBinder>>>& val) { return writeData(val); }
1327
1328status_t Parcel::writeParcelable(const Parcelable& parcelable) { return writeData(parcelable); }
1329
1330status_t Parcel::readUtf8FromUtf16(std::optional<std::string>* str) const { return readData(str); }
1331status_t Parcel::readUtf8FromUtf16(std::unique_ptr<std::string>* str) const { return readData(str); }
1332
1333status_t Parcel::readString16(std::optional<String16>* pArg) const { return readData(pArg); }
1334status_t Parcel::readString16(std::unique_ptr<String16>* pArg) const { return readData(pArg); }
1335
1336status_t Parcel::readByteVector(std::vector<int8_t>* val) const { return readData(val); }
1337status_t Parcel::readByteVector(std::vector<uint8_t>* val) const { return readData(val); }
1338status_t Parcel::readByteVector(std::optional<std::vector<int8_t>>* val) const { return readData(val); }
1339status_t Parcel::readByteVector(std::unique_ptr<std::vector<int8_t>>* val) const { return readData(val); }
1340status_t Parcel::readByteVector(std::optional<std::vector<uint8_t>>* val) const { return readData(val); }
1341status_t Parcel::readByteVector(std::unique_ptr<std::vector<uint8_t>>* val) const { return readData(val); }
1342status_t Parcel::readInt32Vector(std::optional<std::vector<int32_t>>* val) const { return readData(val); }
1343status_t Parcel::readInt32Vector(std::unique_ptr<std::vector<int32_t>>* val) const { return readData(val); }
1344status_t Parcel::readInt32Vector(std::vector<int32_t>* val) const { return readData(val); }
1345status_t Parcel::readInt64Vector(std::optional<std::vector<int64_t>>* val) const { return readData(val); }
1346status_t Parcel::readInt64Vector(std::unique_ptr<std::vector<int64_t>>* val) const { return readData(val); }
1347status_t Parcel::readInt64Vector(std::vector<int64_t>* val) const { return readData(val); }
1348status_t Parcel::readUint64Vector(std::optional<std::vector<uint64_t>>* val) const { return readData(val); }
1349status_t Parcel::readUint64Vector(std::unique_ptr<std::vector<uint64_t>>* val) const { return readData(val); }
1350status_t Parcel::readUint64Vector(std::vector<uint64_t>* val) const { return readData(val); }
1351status_t Parcel::readFloatVector(std::optional<std::vector<float>>* val) const { return readData(val); }
1352status_t Parcel::readFloatVector(std::unique_ptr<std::vector<float>>* val) const { return readData(val); }
1353status_t Parcel::readFloatVector(std::vector<float>* val) const { return readData(val); }
1354status_t Parcel::readDoubleVector(std::optional<std::vector<double>>* val) const { return readData(val); }
1355status_t Parcel::readDoubleVector(std::unique_ptr<std::vector<double>>* val) const { return readData(val); }
1356status_t Parcel::readDoubleVector(std::vector<double>* val) const { return readData(val); }
1357status_t Parcel::readBoolVector(std::optional<std::vector<bool>>* val) const { return readData(val); }
1358status_t Parcel::readBoolVector(std::unique_ptr<std::vector<bool>>* val) const { return readData(val); }
1359status_t Parcel::readBoolVector(std::vector<bool>* val) const { return readData(val); }
1360status_t Parcel::readCharVector(std::optional<std::vector<char16_t>>* val) const { return readData(val); }
1361status_t Parcel::readCharVector(std::unique_ptr<std::vector<char16_t>>* val) const { return readData(val); }
1362status_t Parcel::readCharVector(std::vector<char16_t>* val) const { return readData(val); }
1363
1364status_t Parcel::readString16Vector(
1365 std::optional<std::vector<std::optional<String16>>>* val) const { return readData(val); }
1366status_t Parcel::readString16Vector(
1367 std::unique_ptr<std::vector<std::unique_ptr<String16>>>* val) const { return readData(val); }
1368status_t Parcel::readString16Vector(std::vector<String16>* val) const { return readData(val); }
1369status_t Parcel::readUtf8VectorFromUtf16Vector(
1370 std::optional<std::vector<std::optional<std::string>>>* val) const { return readData(val); }
1371status_t Parcel::readUtf8VectorFromUtf16Vector(
1372 std::unique_ptr<std::vector<std::unique_ptr<std::string>>>* val) const { return readData(val); }
1373status_t Parcel::readUtf8VectorFromUtf16Vector(std::vector<std::string>* val) const { return readData(val); }
1374
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001375status_t Parcel::readUniqueFileDescriptorVector(std::optional<std::vector<unique_fd>>* val) const {
1376 return readData(val);
1377}
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001378status_t Parcel::readUniqueFileDescriptorVector(std::vector<unique_fd>* val) const {
1379 return readData(val);
1380}
Andy Hung49198cf2020-11-18 11:02:39 -08001381
1382status_t Parcel::readStrongBinderVector(std::optional<std::vector<sp<IBinder>>>* val) const { return readData(val); }
1383status_t Parcel::readStrongBinderVector(std::unique_ptr<std::vector<sp<IBinder>>>* val) const { return readData(val); }
1384status_t Parcel::readStrongBinderVector(std::vector<sp<IBinder>>* val) const { return readData(val); }
1385
1386status_t Parcel::readParcelable(Parcelable* parcelable) const { return readData(parcelable); }
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08001387
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001388status_t Parcel::writeInt32(int32_t val)
1389{
Andreas Huber84a6d042009-08-17 13:33:27 -07001390 return writeAligned(val);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001391}
Dan Stoza41a0f2f2014-12-01 10:01:10 -08001392
1393status_t Parcel::writeUint32(uint32_t val)
1394{
1395 return writeAligned(val);
1396}
1397
Marco Nelissen5c0106e2013-10-16 10:57:51 -07001398status_t Parcel::writeInt32Array(size_t len, const int32_t *val) {
Nick Kralevichb6b14232015-04-02 09:36:02 -07001399 if (len > INT32_MAX) {
1400 // don't accept size_t values which may have come from an
1401 // inadvertent conversion from a negative int.
1402 return BAD_VALUE;
1403 }
1404
Marco Nelissen5c0106e2013-10-16 10:57:51 -07001405 if (!val) {
Chad Brubakere59cb432015-06-30 14:03:55 -07001406 return writeInt32(-1);
Marco Nelissen5c0106e2013-10-16 10:57:51 -07001407 }
Chad Brubakere59cb432015-06-30 14:03:55 -07001408 status_t ret = writeInt32(static_cast<uint32_t>(len));
Marco Nelissen5c0106e2013-10-16 10:57:51 -07001409 if (ret == NO_ERROR) {
1410 ret = write(val, len * sizeof(*val));
1411 }
1412 return ret;
1413}
Marco Nelissenf0190bf2014-03-13 14:17:40 -07001414status_t Parcel::writeByteArray(size_t len, const uint8_t *val) {
Nick Kralevichb6b14232015-04-02 09:36:02 -07001415 if (len > INT32_MAX) {
1416 // don't accept size_t values which may have come from an
1417 // inadvertent conversion from a negative int.
1418 return BAD_VALUE;
1419 }
1420
Marco Nelissenf0190bf2014-03-13 14:17:40 -07001421 if (!val) {
Chad Brubakere59cb432015-06-30 14:03:55 -07001422 return writeInt32(-1);
Marco Nelissenf0190bf2014-03-13 14:17:40 -07001423 }
Chad Brubakere59cb432015-06-30 14:03:55 -07001424 status_t ret = writeInt32(static_cast<uint32_t>(len));
Marco Nelissenf0190bf2014-03-13 14:17:40 -07001425 if (ret == NO_ERROR) {
1426 ret = write(val, len * sizeof(*val));
1427 }
1428 return ret;
1429}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001430
Casey Dahlind6848f52015-10-15 15:44:59 -07001431status_t Parcel::writeBool(bool val)
1432{
1433 return writeInt32(int32_t(val));
1434}
1435
1436status_t Parcel::writeChar(char16_t val)
1437{
1438 return writeInt32(int32_t(val));
1439}
1440
1441status_t Parcel::writeByte(int8_t val)
1442{
1443 return writeInt32(int32_t(val));
1444}
1445
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001446status_t Parcel::writeInt64(int64_t val)
1447{
Andreas Huber84a6d042009-08-17 13:33:27 -07001448 return writeAligned(val);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001449}
1450
Ronghua Wu2d13afd2015-03-16 11:11:07 -07001451status_t Parcel::writeUint64(uint64_t val)
1452{
1453 return writeAligned(val);
1454}
1455
Serban Constantinescuf683e012013-11-05 16:53:55 +00001456status_t Parcel::writePointer(uintptr_t val)
1457{
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08001458 return writeAligned<binder_uintptr_t>(val);
Serban Constantinescuf683e012013-11-05 16:53:55 +00001459}
1460
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001461status_t Parcel::writeFloat(float val)
1462{
Andreas Huber84a6d042009-08-17 13:33:27 -07001463 return writeAligned(val);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001464}
1465
Douglas Leungcc1a4bb2013-01-11 15:00:55 -08001466#if defined(__mips__) && defined(__mips_hard_float)
1467
1468status_t Parcel::writeDouble(double val)
1469{
1470 union {
1471 double d;
1472 unsigned long long ll;
1473 } u;
1474 u.d = val;
1475 return writeAligned(u.ll);
1476}
1477
1478#else
1479
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001480status_t Parcel::writeDouble(double val)
1481{
Andreas Huber84a6d042009-08-17 13:33:27 -07001482 return writeAligned(val);
1483}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001484
Douglas Leungcc1a4bb2013-01-11 15:00:55 -08001485#endif
1486
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001487status_t Parcel::writeCString(const char* str)
1488{
1489 return write(str, strlen(str)+1);
1490}
1491
1492status_t Parcel::writeString8(const String8& str)
1493{
Tomasz Wasilczyk0bfea2d2023-08-11 00:06:51 +00001494 return writeString8(str.c_str(), str.size());
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06001495}
1496
1497status_t Parcel::writeString8(const char* str, size_t len)
1498{
1499 if (str == nullptr) return writeInt32(-1);
1500
Jeff Sharkey18220902020-11-05 08:36:20 -07001501 // NOTE: Keep this logic in sync with android_os_Parcel.cpp
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06001502 status_t err = writeInt32(len);
1503 if (err == NO_ERROR) {
1504 uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char));
1505 if (data) {
1506 memcpy(data, str, len);
1507 *reinterpret_cast<char*>(data+len) = 0;
1508 return NO_ERROR;
1509 }
1510 err = mError;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001511 }
1512 return err;
1513}
1514
1515status_t Parcel::writeString16(const String16& str)
1516{
Tomasz Wasilczyk0bfea2d2023-08-11 00:06:51 +00001517 return writeString16(str.c_str(), str.size());
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001518}
1519
1520status_t Parcel::writeString16(const char16_t* str, size_t len)
1521{
Yi Kong91635562018-06-07 14:38:36 -07001522 if (str == nullptr) return writeInt32(-1);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001523
Jeff Sharkey18220902020-11-05 08:36:20 -07001524 // NOTE: Keep this logic in sync with android_os_Parcel.cpp
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001525 status_t err = writeInt32(len);
1526 if (err == NO_ERROR) {
1527 len *= sizeof(char16_t);
1528 uint8_t* data = (uint8_t*)writeInplace(len+sizeof(char16_t));
1529 if (data) {
1530 memcpy(data, str, len);
1531 *reinterpret_cast<char16_t*>(data+len) = 0;
1532 return NO_ERROR;
1533 }
1534 err = mError;
1535 }
1536 return err;
1537}
1538
1539status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
1540{
Steven Morelanda86a3562019-08-01 23:28:34 +00001541 return flattenBinder(val);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001542}
1543
Casey Dahlineb8e15f2015-11-03 13:50:37 -08001544
Casey Dahlinb9872622015-11-25 15:09:45 -08001545status_t Parcel::writeRawNullableParcelable(const Parcelable* parcelable) {
1546 if (!parcelable) {
1547 return writeInt32(0);
1548 }
1549
1550 return writeParcelable(*parcelable);
1551}
1552
Tomasz Wasilczyk232d0b32023-10-09 17:37:16 +00001553#ifndef BINDER_DISABLE_NATIVE_HANDLE
Mathias Agopiana47f02a2009-05-21 16:29:38 -07001554status_t Parcel::writeNativeHandle(const native_handle* handle)
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001555{
Mathias Agopian1d0a95b2009-07-31 16:12:13 -07001556 if (!handle || handle->version != sizeof(native_handle))
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001557 return BAD_TYPE;
1558
1559 status_t err;
Mathias Agopiana47f02a2009-05-21 16:29:38 -07001560 err = writeInt32(handle->numFds);
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001561 if (err != NO_ERROR) return err;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001562
Mathias Agopiana47f02a2009-05-21 16:29:38 -07001563 err = writeInt32(handle->numInts);
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001564 if (err != NO_ERROR) return err;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001565
Mathias Agopiana47f02a2009-05-21 16:29:38 -07001566 for (int i=0 ; err==NO_ERROR && i<handle->numFds ; i++)
1567 err = writeDupFileDescriptor(handle->data[i]);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001568
1569 if (err != NO_ERROR) {
Steve Block9d453682011-12-20 16:23:08 +00001570 ALOGD("write native handle, write dup fd failed");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001571 return err;
1572 }
Mathias Agopiana47f02a2009-05-21 16:29:38 -07001573 err = write(handle->data + handle->numFds, sizeof(int)*handle->numInts);
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001574 return err;
1575}
Tomasz Wasilczyk232d0b32023-10-09 17:37:16 +00001576#endif
The Android Open Source Project5f78a482009-01-20 14:03:58 -08001577
Frederick Mayle69a0c992022-05-26 20:38:39 +00001578status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership) {
1579 if (auto* rpcFields = maybeRpcFields()) {
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001580 std::variant<unique_fd, borrowed_fd> fdVariant;
Frederick Mayle69a0c992022-05-26 20:38:39 +00001581 if (takeOwnership) {
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001582 fdVariant = unique_fd(fd);
Frederick Mayle69a0c992022-05-26 20:38:39 +00001583 } else {
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001584 fdVariant = borrowed_fd(fd);
Frederick Mayle69a0c992022-05-26 20:38:39 +00001585 }
1586 if (!mAllowFds) {
Devin Mooref4c9b482024-07-01 20:22:23 +00001587 ALOGE("FDs are not allowed in this parcel. Both the service and the client must set "
1588 "the FileDescriptorTransportMode and agree on the support.");
Frederick Mayle69a0c992022-05-26 20:38:39 +00001589 return FDS_NOT_ALLOWED;
1590 }
1591 switch (rpcFields->mSession->getFileDescriptorTransportMode()) {
1592 case RpcSession::FileDescriptorTransportMode::NONE: {
Devin Mooref4c9b482024-07-01 20:22:23 +00001593 ALOGE("FDs are not allowed in this RpcSession. Both the service and the client "
1594 "must set "
1595 "the FileDescriptorTransportMode and agree on the support.");
Frederick Mayle69a0c992022-05-26 20:38:39 +00001596 return FDS_NOT_ALLOWED;
1597 }
Andrei Homescu1c18a802022-08-17 04:59:01 +00001598 case RpcSession::FileDescriptorTransportMode::UNIX:
1599 case RpcSession::FileDescriptorTransportMode::TRUSTY: {
Frederick Mayle69a0c992022-05-26 20:38:39 +00001600 if (rpcFields->mFds == nullptr) {
1601 rpcFields->mFds = std::make_unique<decltype(rpcFields->mFds)::element_type>();
1602 }
1603 size_t dataPos = mDataPos;
1604 if (dataPos > UINT32_MAX) {
1605 return NO_MEMORY;
1606 }
1607 if (status_t err = writeInt32(RpcFields::TYPE_NATIVE_FILE_DESCRIPTOR); err != OK) {
1608 return err;
1609 }
1610 if (status_t err = writeInt32(rpcFields->mFds->size()); err != OK) {
1611 return err;
1612 }
1613 rpcFields->mObjectPositions.push_back(dataPos);
1614 rpcFields->mFds->push_back(std::move(fdVariant));
1615 return OK;
1616 }
1617 }
Steven Moreland5553ac42020-11-11 02:14:45 +00001618 }
1619
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001620#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001621 flat_binder_object obj;
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -07001622 obj.hdr.type = BINDER_TYPE_FD;
T.J. Mercierca0c2cb2022-12-19 21:56:35 +00001623 obj.flags = 0;
Arve Hjønnevåg07fd0f12014-02-18 21:10:29 -08001624 obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001625 obj.handle = fd;
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08001626 obj.cookie = takeOwnership ? 1 : 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001627 return writeObject(obj, true);
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001628#else // BINDER_WITH_KERNEL_IPC
1629 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
1630 (void)fd;
1631 (void)takeOwnership;
1632 return INVALID_OPERATION;
1633#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001634}
1635
1636status_t Parcel::writeDupFileDescriptor(int fd)
1637{
Andrei Homescu24ad36e2022-08-04 01:33:33 +00001638 int dupFd;
Tomasz Wasilczyk0d9dec22023-10-06 20:28:49 +00001639 if (status_t err = binder::os::dupFileDescriptor(fd, &dupFd); err != OK) {
Andrei Homescu24ad36e2022-08-04 01:33:33 +00001640 return err;
Jeff Brownd341c712011-11-04 20:19:33 -07001641 }
1642 status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
Casey Dahlin06673e32015-11-23 13:24:23 -08001643 if (err != OK) {
Jeff Brownd341c712011-11-04 20:19:33 -07001644 close(dupFd);
1645 }
1646 return err;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001647}
1648
Dianne Hackborn1941a402016-08-29 12:30:43 -07001649status_t Parcel::writeParcelFileDescriptor(int fd, bool takeOwnership)
1650{
1651 writeInt32(0);
1652 return writeFileDescriptor(fd, takeOwnership);
1653}
1654
Ryo Hashimotobf551892018-05-31 16:58:35 +09001655status_t Parcel::writeDupParcelFileDescriptor(int fd)
1656{
Andrei Homescu24ad36e2022-08-04 01:33:33 +00001657 int dupFd;
Tomasz Wasilczyk0d9dec22023-10-06 20:28:49 +00001658 if (status_t err = binder::os::dupFileDescriptor(fd, &dupFd); err != OK) {
Andrei Homescu24ad36e2022-08-04 01:33:33 +00001659 return err;
Ryo Hashimotobf551892018-05-31 16:58:35 +09001660 }
1661 status_t err = writeParcelFileDescriptor(dupFd, true /*takeOwnership*/);
1662 if (err != OK) {
1663 close(dupFd);
1664 }
1665 return err;
1666}
1667
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07001668status_t Parcel::writeUniqueFileDescriptor(const unique_fd& fd) {
Casey Dahlin06673e32015-11-23 13:24:23 -08001669 return writeDupFileDescriptor(fd.get());
1670}
1671
Jeff Brown13b16042014-11-11 16:44:25 -08001672status_t Parcel::writeBlob(size_t len, bool mutableCopy, WritableBlob* outBlob)
Jeff Brown5707dbf2011-09-23 21:17:56 -07001673{
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00001674#ifdef BINDER_DISABLE_BLOB
1675 (void)len;
1676 (void)mutableCopy;
1677 (void)outBlob;
1678 return INVALID_OPERATION;
1679#else
Nick Kralevichb6b14232015-04-02 09:36:02 -07001680 if (len > INT32_MAX) {
1681 // don't accept size_t values which may have come from an
1682 // inadvertent conversion from a negative int.
1683 return BAD_VALUE;
1684 }
1685
Jeff Brown13b16042014-11-11 16:44:25 -08001686 status_t status;
1687 if (!mAllowFds || len <= BLOB_INPLACE_LIMIT) {
Steve Block6807e592011-10-20 11:56:00 +01001688 ALOGV("writeBlob: write in place");
Jeff Brown13b16042014-11-11 16:44:25 -08001689 status = writeInt32(BLOB_INPLACE);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001690 if (status) return status;
1691
1692 void* ptr = writeInplace(len);
1693 if (!ptr) return NO_MEMORY;
1694
Jeff Brown13b16042014-11-11 16:44:25 -08001695 outBlob->init(-1, ptr, len, false);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001696 return NO_ERROR;
1697 }
1698
Steve Block6807e592011-10-20 11:56:00 +01001699 ALOGV("writeBlob: write to ashmem");
Jeff Brown5707dbf2011-09-23 21:17:56 -07001700 int fd = ashmem_create_region("Parcel Blob", len);
1701 if (fd < 0) return NO_MEMORY;
1702
1703 int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);
1704 if (result < 0) {
Jeff Brownec4e0062011-10-10 14:50:10 -07001705 status = result;
Jeff Brown5707dbf2011-09-23 21:17:56 -07001706 } else {
Yi Kong91635562018-06-07 14:38:36 -07001707 void* ptr = ::mmap(nullptr, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001708 if (ptr == MAP_FAILED) {
1709 status = -errno;
1710 } else {
Jeff Brown13b16042014-11-11 16:44:25 -08001711 if (!mutableCopy) {
1712 result = ashmem_set_prot_region(fd, PROT_READ);
1713 }
Jeff Brown5707dbf2011-09-23 21:17:56 -07001714 if (result < 0) {
Jeff Brownec4e0062011-10-10 14:50:10 -07001715 status = result;
Jeff Brown5707dbf2011-09-23 21:17:56 -07001716 } else {
Jeff Brown13b16042014-11-11 16:44:25 -08001717 status = writeInt32(mutableCopy ? BLOB_ASHMEM_MUTABLE : BLOB_ASHMEM_IMMUTABLE);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001718 if (!status) {
Jeff Brown93ff1f92011-11-04 19:01:44 -07001719 status = writeFileDescriptor(fd, true /*takeOwnership*/);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001720 if (!status) {
Jeff Brown13b16042014-11-11 16:44:25 -08001721 outBlob->init(fd, ptr, len, mutableCopy);
Jeff Brown5707dbf2011-09-23 21:17:56 -07001722 return NO_ERROR;
1723 }
1724 }
1725 }
1726 }
Mike McTernan733610f2024-08-27 11:48:30 +01001727 if (::munmap(ptr, len) == -1) {
1728 ALOGW("munmap() failed: %s", strerror(errno));
1729 }
Jeff Brown5707dbf2011-09-23 21:17:56 -07001730 }
1731 ::close(fd);
1732 return status;
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00001733#endif
Jeff Brown5707dbf2011-09-23 21:17:56 -07001734}
1735
Jeff Brown13b16042014-11-11 16:44:25 -08001736status_t Parcel::writeDupImmutableBlobFileDescriptor(int fd)
1737{
1738 // Must match up with what's done in writeBlob.
1739 if (!mAllowFds) return FDS_NOT_ALLOWED;
1740 status_t status = writeInt32(BLOB_ASHMEM_IMMUTABLE);
1741 if (status) return status;
1742 return writeDupFileDescriptor(fd);
1743}
1744
Mathias Agopiane1424282013-07-29 21:24:40 -07001745status_t Parcel::write(const FlattenableHelperInterface& val)
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001746{
1747 status_t err;
1748
1749 // size if needed
Mathias Agopiane1424282013-07-29 21:24:40 -07001750 const size_t len = val.getFlattenedSize();
1751 const size_t fd_count = val.getFdCount();
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001752
Andrei Homescu1519b982022-06-09 02:04:44 +00001753 if ((len > INT32_MAX) || (fd_count > kMaxFds)) {
Nick Kralevichb6b14232015-04-02 09:36:02 -07001754 // don't accept size_t values which may have come from an
1755 // inadvertent conversion from a negative int.
1756 return BAD_VALUE;
1757 }
1758
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001759 err = this->writeInt32(len);
1760 if (err) return err;
1761
1762 err = this->writeInt32(fd_count);
1763 if (err) return err;
1764
1765 // payload
Martijn Coenenf8542382018-04-04 11:46:56 +02001766 void* const buf = this->writeInplace(len);
Yi Kong91635562018-06-07 14:38:36 -07001767 if (buf == nullptr)
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001768 return BAD_VALUE;
1769
Yi Kong91635562018-06-07 14:38:36 -07001770 int* fds = nullptr;
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001771 if (fd_count) {
Christopher Tatee4e0ae82016-03-24 16:03:44 -07001772 fds = new (std::nothrow) int[fd_count];
1773 if (fds == nullptr) {
1774 ALOGE("write: failed to allocate requested %zu fds", fd_count);
1775 return BAD_VALUE;
1776 }
Mathias Agopian98e71dd2010-02-11 17:30:52 -08001777 }
1778
1779 err = val.flatten(buf, len, fds, fd_count);
1780 for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
1781 err = this->writeDupFileDescriptor( fds[i] );
1782 }
1783
1784 if (fd_count) {
1785 delete [] fds;
1786 }
1787
1788 return err;
1789}
1790
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001791status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)
1792{
Frederick Mayled3c595a2022-05-09 23:02:54 +00001793 auto* kernelFields = maybeKernelFields();
1794 LOG_ALWAYS_FATAL_IF(kernelFields == nullptr, "Can't write flat_binder_object to RPC Parcel");
1795
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001796#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001797 const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
Frederick Mayled3c595a2022-05-09 23:02:54 +00001798 const bool enoughObjects = kernelFields->mObjectsSize < kernelFields->mObjectsCapacity;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001799 if (enoughData && enoughObjects) {
1800restart_write:
1801 *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001802
Christopher Tate98e67d32015-06-03 18:44:15 -07001803 // remember if it's a file descriptor
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -07001804 if (val.hdr.type == BINDER_TYPE_FD) {
Christopher Tate98e67d32015-06-03 18:44:15 -07001805 if (!mAllowFds) {
1806 // fail before modifying our object index
1807 return FDS_NOT_ALLOWED;
1808 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00001809 kernelFields->mHasFds = kernelFields->mFdsKnown = true;
Christopher Tate98e67d32015-06-03 18:44:15 -07001810 }
1811
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001812 // Need to write meta-data?
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08001813 if (nullMetaData || val.binder != 0) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00001814 kernelFields->mObjects[kernelFields->mObjectsSize] = mDataPos;
Steven Morelandc673f1f2021-10-07 18:23:35 -07001815 acquire_object(ProcessState::self(), val, this);
Frederick Mayled3c595a2022-05-09 23:02:54 +00001816 kernelFields->mObjectsSize++;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001817 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001818
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001819 return finishWrite(sizeof(flat_binder_object));
1820 }
1821
1822 if (!enoughData) {
1823 const status_t err = growData(sizeof(val));
1824 if (err != NO_ERROR) return err;
1825 }
1826 if (!enoughObjects) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00001827 if (kernelFields->mObjectsSize > SIZE_MAX - 2) return NO_MEMORY; // overflow
1828 if ((kernelFields->mObjectsSize + 2) > SIZE_MAX / 3) return NO_MEMORY; // overflow
1829 size_t newSize = ((kernelFields->mObjectsSize + 2) * 3) / 2;
Martijn Coenen93fe5182020-01-22 10:46:25 +01001830 if (newSize > SIZE_MAX / sizeof(binder_size_t)) return NO_MEMORY; // overflow
Frederick Mayled3c595a2022-05-09 23:02:54 +00001831 binder_size_t* objects =
1832 (binder_size_t*)realloc(kernelFields->mObjects, newSize * sizeof(binder_size_t));
Yi Kong91635562018-06-07 14:38:36 -07001833 if (objects == nullptr) return NO_MEMORY;
Frederick Mayled3c595a2022-05-09 23:02:54 +00001834 kernelFields->mObjects = objects;
1835 kernelFields->mObjectsCapacity = newSize;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001836 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001837
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001838 goto restart_write;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001839#else // BINDER_WITH_KERNEL_IPC
1840 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
1841 (void)val;
1842 (void)nullMetaData;
1843 return INVALID_OPERATION;
1844#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001845}
1846
Brad Fitzpatrick837a0d02010-07-13 15:33:35 -07001847status_t Parcel::writeNoException()
1848{
Christopher Wiley09eb7492015-11-09 15:06:15 -08001849 binder::Status status;
1850 return status.writeToParcel(this);
Brad Fitzpatrick837a0d02010-07-13 15:33:35 -07001851}
1852
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001853status_t Parcel::validateReadData(size_t upperBound) const
1854{
Frederick Mayled3c595a2022-05-09 23:02:54 +00001855 const auto* kernelFields = maybeKernelFields();
1856 if (kernelFields == nullptr) {
1857 // Can't validate RPC Parcel reads because the location of binder
1858 // objects is unknown.
1859 return OK;
1860 }
1861
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001862#ifdef BINDER_WITH_KERNEL_IPC
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001863 // Don't allow non-object reads on object data
Frederick Mayled3c595a2022-05-09 23:02:54 +00001864 if (kernelFields->mObjectsSorted || kernelFields->mObjectsSize <= 1) {
1865 data_sorted:
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001866 // Expect to check only against the next object
Frederick Mayled3c595a2022-05-09 23:02:54 +00001867 if (kernelFields->mNextObjectHint < kernelFields->mObjectsSize &&
1868 upperBound > kernelFields->mObjects[kernelFields->mNextObjectHint]) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001869 // For some reason the current read position is greater than the next object
1870 // hint. Iterate until we find the right object
Frederick Mayled3c595a2022-05-09 23:02:54 +00001871 size_t nextObject = kernelFields->mNextObjectHint;
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001872 do {
Frederick Mayled3c595a2022-05-09 23:02:54 +00001873 if (mDataPos < kernelFields->mObjects[nextObject] + sizeof(flat_binder_object)) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001874 // Requested info overlaps with an object
Steven Moreland3a667492023-06-02 21:41:39 +00001875 if (!mServiceFuzzing) {
1876 ALOGE("Attempt to read from protected data in Parcel %p", this);
1877 }
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001878 return PERMISSION_DENIED;
1879 }
1880 nextObject++;
Frederick Mayled3c595a2022-05-09 23:02:54 +00001881 } while (nextObject < kernelFields->mObjectsSize &&
1882 upperBound > kernelFields->mObjects[nextObject]);
1883 kernelFields->mNextObjectHint = nextObject;
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001884 }
1885 return NO_ERROR;
1886 }
1887 // Quickly determine if mObjects is sorted.
Frederick Mayled3c595a2022-05-09 23:02:54 +00001888 binder_size_t* currObj = kernelFields->mObjects + kernelFields->mObjectsSize - 1;
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001889 binder_size_t* prevObj = currObj;
Frederick Mayled3c595a2022-05-09 23:02:54 +00001890 while (currObj > kernelFields->mObjects) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001891 prevObj--;
1892 if(*prevObj > *currObj) {
1893 goto data_unsorted;
1894 }
1895 currObj--;
1896 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00001897 kernelFields->mObjectsSorted = true;
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001898 goto data_sorted;
1899
1900data_unsorted:
1901 // Insertion Sort mObjects
1902 // Great for mostly sorted lists. If randomly sorted or reverse ordered mObjects become common,
1903 // switch to std::sort(mObjects, mObjects + mObjectsSize);
Frederick Mayled3c595a2022-05-09 23:02:54 +00001904 for (binder_size_t* iter0 = kernelFields->mObjects + 1;
1905 iter0 < kernelFields->mObjects + kernelFields->mObjectsSize; iter0++) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001906 binder_size_t temp = *iter0;
1907 binder_size_t* iter1 = iter0 - 1;
Frederick Mayled3c595a2022-05-09 23:02:54 +00001908 while (iter1 >= kernelFields->mObjects && *iter1 > temp) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001909 *(iter1 + 1) = *iter1;
1910 iter1--;
1911 }
1912 *(iter1 + 1) = temp;
1913 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00001914 kernelFields->mNextObjectHint = 0;
1915 kernelFields->mObjectsSorted = true;
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001916 goto data_sorted;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00001917#else // BINDER_WITH_KERNEL_IPC
1918 (void)upperBound;
1919 return NO_ERROR;
1920#endif // BINDER_WITH_KERNEL_IPC
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001921}
1922
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001923status_t Parcel::read(void* outData, size_t len) const
1924{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001925 if (len > INT32_MAX) {
1926 // don't accept size_t values which may have come from an
1927 // inadvertent conversion from a negative int.
1928 return BAD_VALUE;
1929 }
1930
1931 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1932 && len <= pad_size(len)) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00001933 const auto* kernelFields = maybeKernelFields();
1934 if (kernelFields != nullptr && kernelFields->mObjectsSize > 0) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001935 status_t err = validateReadData(mDataPos + pad_size(len));
Michael Wachenschwanza17f0222018-04-17 16:52:40 -07001936 if(err != NO_ERROR) {
1937 // Still increment the data position by the expected length
1938 mDataPos += pad_size(len);
1939 ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
1940 return err;
1941 }
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001942 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001943 memcpy(outData, mData+mDataPos, len);
Nick Kralevichb6b14232015-04-02 09:36:02 -07001944 mDataPos += pad_size(len);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001945 ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001946 return NO_ERROR;
1947 }
1948 return NOT_ENOUGH_DATA;
1949}
1950
1951const void* Parcel::readInplace(size_t len) const
1952{
Nick Kralevichb6b14232015-04-02 09:36:02 -07001953 if (len > INT32_MAX) {
1954 // don't accept size_t values which may have come from an
1955 // inadvertent conversion from a negative int.
Yi Kong91635562018-06-07 14:38:36 -07001956 return nullptr;
Nick Kralevichb6b14232015-04-02 09:36:02 -07001957 }
1958
1959 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
1960 && len <= pad_size(len)) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00001961 const auto* kernelFields = maybeKernelFields();
1962 if (kernelFields != nullptr && kernelFields->mObjectsSize > 0) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001963 status_t err = validateReadData(mDataPos + pad_size(len));
Michael Wachenschwanza17f0222018-04-17 16:52:40 -07001964 if(err != NO_ERROR) {
1965 // Still increment the data position by the expected length
1966 mDataPos += pad_size(len);
1967 ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
Yi Kong91635562018-06-07 14:38:36 -07001968 return nullptr;
Michael Wachenschwanza17f0222018-04-17 16:52:40 -07001969 }
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08001970 }
1971
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001972 const void* data = mData+mDataPos;
Nick Kralevichb6b14232015-04-02 09:36:02 -07001973 mDataPos += pad_size(len);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07001974 ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001975 return data;
1976 }
Yi Kong91635562018-06-07 14:38:36 -07001977 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07001978}
1979
Steven Morelandd4f73fb2021-05-14 19:50:52 +00001980status_t Parcel::readOutVectorSizeWithCheck(size_t elmSize, int32_t* size) const {
1981 if (status_t status = readInt32(size); status != OK) return status;
1982 if (*size < 0) return OK; // may be null, client to handle
1983
1984 LOG_ALWAYS_FATAL_IF(elmSize > INT32_MAX, "Cannot have element as big as %zu", elmSize);
1985
1986 // approximation, can't know max element size (e.g. if it makes heap
1987 // allocations)
1988 static_assert(sizeof(int) == sizeof(int32_t), "Android is LP64");
1989 int32_t allocationSize;
1990 if (__builtin_smul_overflow(elmSize, *size, &allocationSize)) return NO_MEMORY;
1991
1992 // High limit of 1MB since something this big could never be returned. Could
1993 // probably scope this down, but might impact very specific usecases.
1994 constexpr int32_t kMaxAllocationSize = 1 * 1000 * 1000;
1995
1996 if (allocationSize >= kMaxAllocationSize) {
1997 return NO_MEMORY;
1998 }
1999
2000 return OK;
2001}
2002
Andreas Huber84a6d042009-08-17 13:33:27 -07002003template<class T>
2004status_t Parcel::readAligned(T *pArg) const {
Elliott Hughes42a9b942020-08-17 15:53:31 -07002005 static_assert(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
Andrei Homescue33238e2022-03-29 22:50:00 +00002006 static_assert(std::is_trivially_copyable_v<T>);
Andreas Huber84a6d042009-08-17 13:33:27 -07002007
2008 if ((mDataPos+sizeof(T)) <= mDataSize) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00002009 const auto* kernelFields = maybeKernelFields();
2010 if (kernelFields != nullptr && kernelFields->mObjectsSize > 0) {
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08002011 status_t err = validateReadData(mDataPos + sizeof(T));
Michael Wachenschwanza17f0222018-04-17 16:52:40 -07002012 if(err != NO_ERROR) {
2013 // Still increment the data position by the expected length
2014 mDataPos += sizeof(T);
2015 return err;
2016 }
Michael Wachenschwanzc5176812017-11-17 18:25:05 -08002017 }
2018
Andrei Homescue33238e2022-03-29 22:50:00 +00002019 memcpy(pArg, mData + mDataPos, sizeof(T));
Andreas Huber84a6d042009-08-17 13:33:27 -07002020 mDataPos += sizeof(T);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002021 return NO_ERROR;
2022 } else {
2023 return NOT_ENOUGH_DATA;
2024 }
2025}
2026
Andreas Huber84a6d042009-08-17 13:33:27 -07002027template<class T>
2028T Parcel::readAligned() const {
2029 T result;
2030 if (readAligned(&result) != NO_ERROR) {
2031 result = 0;
2032 }
2033
2034 return result;
2035}
2036
2037template<class T>
2038status_t Parcel::writeAligned(T val) {
Elliott Hughes42a9b942020-08-17 15:53:31 -07002039 static_assert(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
Andrei Homescue33238e2022-03-29 22:50:00 +00002040 static_assert(std::is_trivially_copyable_v<T>);
Andreas Huber84a6d042009-08-17 13:33:27 -07002041
2042 if ((mDataPos+sizeof(val)) <= mDataCapacity) {
2043restart_write:
Andrei Homescue33238e2022-03-29 22:50:00 +00002044 memcpy(mData + mDataPos, &val, sizeof(val));
Andreas Huber84a6d042009-08-17 13:33:27 -07002045 return finishWrite(sizeof(val));
2046 }
2047
2048 status_t err = growData(sizeof(val));
2049 if (err == NO_ERROR) goto restart_write;
2050 return err;
2051}
2052
2053status_t Parcel::readInt32(int32_t *pArg) const
2054{
2055 return readAligned(pArg);
2056}
2057
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002058int32_t Parcel::readInt32() const
2059{
Andreas Huber84a6d042009-08-17 13:33:27 -07002060 return readAligned<int32_t>();
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002061}
2062
Dan Stoza41a0f2f2014-12-01 10:01:10 -08002063status_t Parcel::readUint32(uint32_t *pArg) const
2064{
2065 return readAligned(pArg);
2066}
2067
2068uint32_t Parcel::readUint32() const
2069{
2070 return readAligned<uint32_t>();
2071}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002072
2073status_t Parcel::readInt64(int64_t *pArg) const
2074{
Andreas Huber84a6d042009-08-17 13:33:27 -07002075 return readAligned(pArg);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002076}
2077
2078
2079int64_t Parcel::readInt64() const
2080{
Andreas Huber84a6d042009-08-17 13:33:27 -07002081 return readAligned<int64_t>();
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002082}
2083
Ronghua Wu2d13afd2015-03-16 11:11:07 -07002084status_t Parcel::readUint64(uint64_t *pArg) const
2085{
2086 return readAligned(pArg);
2087}
2088
2089uint64_t Parcel::readUint64() const
2090{
2091 return readAligned<uint64_t>();
2092}
2093
Serban Constantinescuf683e012013-11-05 16:53:55 +00002094status_t Parcel::readPointer(uintptr_t *pArg) const
2095{
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002096 status_t ret;
2097 binder_uintptr_t ptr;
2098 ret = readAligned(&ptr);
2099 if (!ret)
2100 *pArg = ptr;
2101 return ret;
Serban Constantinescuf683e012013-11-05 16:53:55 +00002102}
2103
2104uintptr_t Parcel::readPointer() const
2105{
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002106 return readAligned<binder_uintptr_t>();
Serban Constantinescuf683e012013-11-05 16:53:55 +00002107}
2108
2109
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002110status_t Parcel::readFloat(float *pArg) const
2111{
Andreas Huber84a6d042009-08-17 13:33:27 -07002112 return readAligned(pArg);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002113}
2114
2115
2116float Parcel::readFloat() const
2117{
Andreas Huber84a6d042009-08-17 13:33:27 -07002118 return readAligned<float>();
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002119}
2120
Douglas Leungcc1a4bb2013-01-11 15:00:55 -08002121#if defined(__mips__) && defined(__mips_hard_float)
2122
2123status_t Parcel::readDouble(double *pArg) const
2124{
2125 union {
2126 double d;
2127 unsigned long long ll;
2128 } u;
Narayan Kamath2c68d382014-06-04 15:04:29 +01002129 u.d = 0;
Douglas Leungcc1a4bb2013-01-11 15:00:55 -08002130 status_t status;
2131 status = readAligned(&u.ll);
2132 *pArg = u.d;
2133 return status;
2134}
2135
2136double Parcel::readDouble() const
2137{
2138 union {
2139 double d;
2140 unsigned long long ll;
2141 } u;
2142 u.ll = readAligned<unsigned long long>();
2143 return u.d;
2144}
2145
2146#else
2147
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002148status_t Parcel::readDouble(double *pArg) const
2149{
Andreas Huber84a6d042009-08-17 13:33:27 -07002150 return readAligned(pArg);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002151}
2152
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002153double Parcel::readDouble() const
2154{
Andreas Huber84a6d042009-08-17 13:33:27 -07002155 return readAligned<double>();
2156}
2157
Douglas Leungcc1a4bb2013-01-11 15:00:55 -08002158#endif
2159
Casey Dahlind6848f52015-10-15 15:44:59 -07002160status_t Parcel::readBool(bool *pArg) const
2161{
Manoj Gupta6eb62052017-07-12 10:29:15 -07002162 int32_t tmp = 0;
Casey Dahlind6848f52015-10-15 15:44:59 -07002163 status_t ret = readInt32(&tmp);
2164 *pArg = (tmp != 0);
2165 return ret;
2166}
2167
2168bool Parcel::readBool() const
2169{
2170 return readInt32() != 0;
2171}
2172
2173status_t Parcel::readChar(char16_t *pArg) const
2174{
Manoj Gupta6eb62052017-07-12 10:29:15 -07002175 int32_t tmp = 0;
Casey Dahlind6848f52015-10-15 15:44:59 -07002176 status_t ret = readInt32(&tmp);
2177 *pArg = char16_t(tmp);
2178 return ret;
2179}
2180
2181char16_t Parcel::readChar() const
2182{
2183 return char16_t(readInt32());
2184}
2185
2186status_t Parcel::readByte(int8_t *pArg) const
2187{
Manoj Gupta6eb62052017-07-12 10:29:15 -07002188 int32_t tmp = 0;
Casey Dahlind6848f52015-10-15 15:44:59 -07002189 status_t ret = readInt32(&tmp);
2190 *pArg = int8_t(tmp);
2191 return ret;
2192}
2193
2194int8_t Parcel::readByte() const
2195{
2196 return int8_t(readInt32());
2197}
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002198
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08002199status_t Parcel::readUtf8FromUtf16(std::string* str) const {
2200 size_t utf16Size = 0;
2201 const char16_t* src = readString16Inplace(&utf16Size);
2202 if (!src) {
2203 return UNEXPECTED_NULL;
2204 }
2205
2206 // Save ourselves the trouble, we're done.
2207 if (utf16Size == 0u) {
2208 str->clear();
2209 return NO_ERROR;
2210 }
2211
Sergio Giro9b39ebe2016-06-28 18:19:33 +01002212 // Allow for closing '\0'
2213 ssize_t utf8Size = utf16_to_utf8_length(src, utf16Size) + 1;
2214 if (utf8Size < 1) {
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08002215 return BAD_VALUE;
2216 }
2217 // Note that while it is probably safe to assume string::resize keeps a
Sergio Giro9b39ebe2016-06-28 18:19:33 +01002218 // spare byte around for the trailing null, we still pass the size including the trailing null
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08002219 str->resize(utf8Size);
Sergio Giro9b39ebe2016-06-28 18:19:33 +01002220 utf16_to_utf8(src, utf16Size, &((*str)[0]), utf8Size);
2221 str->resize(utf8Size - 1);
Christopher Wiley9a5e32f2016-01-28 16:56:53 -08002222 return NO_ERROR;
2223}
2224
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002225const char* Parcel::readCString() const
2226{
Steven Morelandd0d4b582019-05-17 13:14:06 -07002227 if (mDataPos < mDataSize) {
2228 const size_t avail = mDataSize-mDataPos;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002229 const char* str = reinterpret_cast<const char*>(mData+mDataPos);
2230 // is the string's trailing NUL within the parcel's valid bounds?
2231 const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
2232 if (eos) {
2233 const size_t len = eos - str;
Nick Kralevichb6b14232015-04-02 09:36:02 -07002234 mDataPos += pad_size(len+1);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002235 ALOGV("readCString Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002236 return str;
2237 }
2238 }
Yi Kong91635562018-06-07 14:38:36 -07002239 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002240}
2241
2242String8 Parcel::readString8() const
2243{
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002244 size_t len;
2245 const char* str = readString8Inplace(&len);
2246 if (str) return String8(str, len);
Steven Moreland3a667492023-06-02 21:41:39 +00002247
2248 if (!mServiceFuzzing) {
2249 ALOGE("Reading a NULL string not supported here.");
2250 }
2251
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002252 return String8();
Roshan Pius87b64d22016-07-18 12:51:02 -07002253}
2254
2255status_t Parcel::readString8(String8* pArg) const
2256{
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002257 size_t len;
2258 const char* str = readString8Inplace(&len);
2259 if (str) {
2260 pArg->setTo(str, len);
2261 return 0;
2262 } else {
Roshan Pius87b64d22016-07-18 12:51:02 -07002263 *pArg = String8();
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002264 return UNEXPECTED_NULL;
Roshan Pius87b64d22016-07-18 12:51:02 -07002265 }
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002266}
2267
2268const char* Parcel::readString8Inplace(size_t* outLen) const
2269{
2270 int32_t size = readInt32();
2271 // watch for potential int overflow from size+1
2272 if (size >= 0 && size < INT32_MAX) {
2273 *outLen = size;
2274 const char* str = (const char*)readInplace(size+1);
Steven Moreland61d0f842020-12-04 21:13:03 +00002275 if (str != nullptr) {
2276 if (str[size] == '\0') {
2277 return str;
2278 }
2279 android_errorWriteLog(0x534e4554, "172655291");
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002280 }
Roshan Pius87b64d22016-07-18 12:51:02 -07002281 }
Jeff Sharkey2f8bdb52020-04-19 21:41:26 -06002282 *outLen = 0;
2283 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002284}
2285
2286String16 Parcel::readString16() const
2287{
2288 size_t len;
2289 const char16_t* str = readString16Inplace(&len);
2290 if (str) return String16(str, len);
Steven Moreland3a667492023-06-02 21:41:39 +00002291
2292 if (!mServiceFuzzing) {
2293 ALOGE("Reading a NULL string not supported here.");
2294 }
2295
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002296 return String16();
2297}
2298
Casey Dahlinb9872622015-11-25 15:09:45 -08002299
Casey Dahlin451ff582015-10-19 18:12:18 -07002300status_t Parcel::readString16(String16* pArg) const
2301{
2302 size_t len;
2303 const char16_t* str = readString16Inplace(&len);
2304 if (str) {
Casey Dahlin1515ea12015-10-20 16:26:23 -07002305 pArg->setTo(str, len);
Casey Dahlin451ff582015-10-19 18:12:18 -07002306 return 0;
2307 } else {
2308 *pArg = String16();
Christopher Wiley4db672d2015-11-10 09:44:30 -08002309 return UNEXPECTED_NULL;
Casey Dahlin451ff582015-10-19 18:12:18 -07002310 }
2311}
2312
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002313const char16_t* Parcel::readString16Inplace(size_t* outLen) const
2314{
2315 int32_t size = readInt32();
2316 // watch for potential int overflow from size+1
2317 if (size >= 0 && size < INT32_MAX) {
2318 *outLen = size;
2319 const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
Steven Moreland61d0f842020-12-04 21:13:03 +00002320 if (str != nullptr) {
2321 if (str[size] == u'\0') {
2322 return str;
2323 }
2324 android_errorWriteLog(0x534e4554, "172655291");
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002325 }
2326 }
2327 *outLen = 0;
Yi Kong91635562018-06-07 14:38:36 -07002328 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002329}
2330
Casey Dahlinf0c13772015-10-27 18:33:56 -07002331status_t Parcel::readStrongBinder(sp<IBinder>* val) const
2332{
Christopher Wiley35d77ca2016-03-08 10:49:51 -08002333 status_t status = readNullableStrongBinder(val);
2334 if (status == OK && !val->get()) {
Steven Moreland3a667492023-06-02 21:41:39 +00002335 if (!mServiceFuzzing) {
2336 ALOGW("Expecting binder but got null!");
2337 }
Christopher Wiley35d77ca2016-03-08 10:49:51 -08002338 status = UNEXPECTED_NULL;
2339 }
2340 return status;
2341}
2342
2343status_t Parcel::readNullableStrongBinder(sp<IBinder>* val) const
2344{
Steven Morelanda86a3562019-08-01 23:28:34 +00002345 return unflattenBinder(val);
Casey Dahlinf0c13772015-10-27 18:33:56 -07002346}
2347
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002348sp<IBinder> Parcel::readStrongBinder() const
2349{
2350 sp<IBinder> val;
Christopher Wiley35d77ca2016-03-08 10:49:51 -08002351 // Note that a lot of code in Android reads binders by hand with this
2352 // method, and that code has historically been ok with getting nullptr
2353 // back (while ignoring error codes).
2354 readNullableStrongBinder(&val);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002355 return val;
2356}
2357
Brad Fitzpatrick837a0d02010-07-13 15:33:35 -07002358int32_t Parcel::readExceptionCode() const
2359{
Christopher Wiley09eb7492015-11-09 15:06:15 -08002360 binder::Status status;
2361 status.readFromParcel(*this);
2362 return status.exceptionCode();
Brad Fitzpatrick837a0d02010-07-13 15:33:35 -07002363}
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002364
Tomasz Wasilczyk232d0b32023-10-09 17:37:16 +00002365#ifndef BINDER_DISABLE_NATIVE_HANDLE
Mathias Agopiana47f02a2009-05-21 16:29:38 -07002366native_handle* Parcel::readNativeHandle() const
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002367{
2368 int numFds, numInts;
2369 status_t err;
2370 err = readInt32(&numFds);
Yi Kong91635562018-06-07 14:38:36 -07002371 if (err != NO_ERROR) return nullptr;
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002372 err = readInt32(&numInts);
Yi Kong91635562018-06-07 14:38:36 -07002373 if (err != NO_ERROR) return nullptr;
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002374
Mathias Agopiana47f02a2009-05-21 16:29:38 -07002375 native_handle* h = native_handle_create(numFds, numInts);
Adam Lesinskieaac99a2015-05-12 17:35:48 -07002376 if (!h) {
Yi Kong91635562018-06-07 14:38:36 -07002377 return nullptr;
Adam Lesinskieaac99a2015-05-12 17:35:48 -07002378 }
2379
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002380 for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
Nick Kralevichec9ec7d2016-12-17 19:47:27 -08002381 h->data[i] = fcntl(readFileDescriptor(), F_DUPFD_CLOEXEC, 0);
Marco Nelissen1de79662016-04-26 08:44:09 -07002382 if (h->data[i] < 0) {
2383 for (int j = 0; j < i; j++) {
2384 close(h->data[j]);
2385 }
2386 native_handle_delete(h);
Yi Kong91635562018-06-07 14:38:36 -07002387 return nullptr;
Marco Nelissen1de79662016-04-26 08:44:09 -07002388 }
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002389 }
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002390 err = read(h->data + numFds, sizeof(int)*numInts);
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002391 if (err != NO_ERROR) {
Mathias Agopiana47f02a2009-05-21 16:29:38 -07002392 native_handle_close(h);
2393 native_handle_delete(h);
Yi Kong91635562018-06-07 14:38:36 -07002394 h = nullptr;
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002395 }
2396 return h;
2397}
Tomasz Wasilczyk232d0b32023-10-09 17:37:16 +00002398#endif
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002399
Frederick Mayle69a0c992022-05-26 20:38:39 +00002400int Parcel::readFileDescriptor() const {
2401 if (const auto* rpcFields = maybeRpcFields()) {
2402 if (!std::binary_search(rpcFields->mObjectPositions.begin(),
2403 rpcFields->mObjectPositions.end(), mDataPos)) {
Steven Moreland3a667492023-06-02 21:41:39 +00002404 if (!mServiceFuzzing) {
2405 ALOGW("Attempt to read file descriptor from Parcel %p at offset %zu that is not in "
2406 "the object list",
2407 this, mDataPos);
2408 }
Frederick Mayle69a0c992022-05-26 20:38:39 +00002409 return BAD_TYPE;
2410 }
2411
2412 int32_t objectType = readInt32();
2413 if (objectType != RpcFields::TYPE_NATIVE_FILE_DESCRIPTOR) {
2414 return BAD_TYPE;
2415 }
2416
2417 int32_t fdIndex = readInt32();
2418 if (rpcFields->mFds == nullptr || fdIndex < 0 ||
2419 static_cast<size_t>(fdIndex) >= rpcFields->mFds->size()) {
2420 ALOGE("RPC Parcel contains invalid file descriptor index. index=%d fd_count=%zu",
2421 fdIndex, rpcFields->mFds ? rpcFields->mFds->size() : 0);
2422 return BAD_VALUE;
2423 }
2424 return toRawFd(rpcFields->mFds->at(fdIndex));
2425 }
2426
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002427#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002428 const flat_binder_object* flat = readObject(true);
Casey Dahlin06673e32015-11-23 13:24:23 -08002429
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -07002430 if (flat && flat->hdr.type == BINDER_TYPE_FD) {
Casey Dahlin06673e32015-11-23 13:24:23 -08002431 return flat->handle;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002432 }
Casey Dahlin06673e32015-11-23 13:24:23 -08002433
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002434 return BAD_TYPE;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002435#else // BINDER_WITH_KERNEL_IPC
2436 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
2437 return INVALID_OPERATION;
2438#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002439}
2440
Frederick Mayle69a0c992022-05-26 20:38:39 +00002441int Parcel::readParcelFileDescriptor() const {
Dianne Hackborn1941a402016-08-29 12:30:43 -07002442 int32_t hasComm = readInt32();
2443 int fd = readFileDescriptor();
2444 if (hasComm != 0) {
Steven Morelandb73806a2018-11-12 19:35:47 -08002445 // detach (owned by the binder driver)
2446 int comm = readFileDescriptor();
2447
2448 // warning: this must be kept in sync with:
2449 // frameworks/base/core/java/android/os/ParcelFileDescriptor.java
2450 enum ParcelFileDescriptorStatus {
2451 DETACHED = 2,
2452 };
2453
2454#if BYTE_ORDER == BIG_ENDIAN
2455 const int32_t message = ParcelFileDescriptorStatus::DETACHED;
2456#endif
2457#if BYTE_ORDER == LITTLE_ENDIAN
2458 const int32_t message = __builtin_bswap32(ParcelFileDescriptorStatus::DETACHED);
2459#endif
2460
2461 ssize_t written = TEMP_FAILURE_RETRY(
2462 ::write(comm, &message, sizeof(message)));
2463
Krzysztof Kosińskia8406892021-02-02 17:59:43 -08002464 if (written != sizeof(message)) {
Steven Morelandb73806a2018-11-12 19:35:47 -08002465 ALOGW("Failed to detach ParcelFileDescriptor written: %zd err: %s",
2466 written, strerror(errno));
2467 return BAD_TYPE;
2468 }
Dianne Hackborn1941a402016-08-29 12:30:43 -07002469 }
2470 return fd;
2471}
2472
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07002473status_t Parcel::readUniqueFileDescriptor(unique_fd* val) const {
Casey Dahlin06673e32015-11-23 13:24:23 -08002474 int got = readFileDescriptor();
2475
2476 if (got == BAD_TYPE) {
2477 return BAD_TYPE;
2478 }
2479
Andrei Homescu24ad36e2022-08-04 01:33:33 +00002480 int dupFd;
Tomasz Wasilczyk0d9dec22023-10-06 20:28:49 +00002481 if (status_t err = binder::os::dupFileDescriptor(got, &dupFd); err != OK) {
Andrei Homescu24ad36e2022-08-04 01:33:33 +00002482 return BAD_VALUE;
2483 }
2484
2485 val->reset(dupFd);
Casey Dahlin06673e32015-11-23 13:24:23 -08002486
2487 if (val->get() < 0) {
2488 return BAD_VALUE;
2489 }
2490
2491 return OK;
2492}
2493
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07002494status_t Parcel::readUniqueParcelFileDescriptor(unique_fd* val) const {
Ryo Hashimotobf551892018-05-31 16:58:35 +09002495 int got = readParcelFileDescriptor();
2496
2497 if (got == BAD_TYPE) {
2498 return BAD_TYPE;
2499 }
2500
Andrei Homescu24ad36e2022-08-04 01:33:33 +00002501 int dupFd;
Tomasz Wasilczyk0d9dec22023-10-06 20:28:49 +00002502 if (status_t err = binder::os::dupFileDescriptor(got, &dupFd); err != OK) {
Andrei Homescu24ad36e2022-08-04 01:33:33 +00002503 return BAD_VALUE;
2504 }
2505
2506 val->reset(dupFd);
Ryo Hashimotobf551892018-05-31 16:58:35 +09002507
2508 if (val->get() < 0) {
2509 return BAD_VALUE;
2510 }
2511
2512 return OK;
2513}
Casey Dahlin06673e32015-11-23 13:24:23 -08002514
Jeff Brown5707dbf2011-09-23 21:17:56 -07002515status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob) const
2516{
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00002517#ifdef BINDER_DISABLE_BLOB
2518 (void)len;
2519 (void)outBlob;
2520 return INVALID_OPERATION;
2521#else
Jeff Brown13b16042014-11-11 16:44:25 -08002522 int32_t blobType;
2523 status_t status = readInt32(&blobType);
Jeff Brown5707dbf2011-09-23 21:17:56 -07002524 if (status) return status;
2525
Jeff Brown13b16042014-11-11 16:44:25 -08002526 if (blobType == BLOB_INPLACE) {
Steve Block6807e592011-10-20 11:56:00 +01002527 ALOGV("readBlob: read in place");
Jeff Brown5707dbf2011-09-23 21:17:56 -07002528 const void* ptr = readInplace(len);
2529 if (!ptr) return BAD_VALUE;
2530
Jeff Brown13b16042014-11-11 16:44:25 -08002531 outBlob->init(-1, const_cast<void*>(ptr), len, false);
Jeff Brown5707dbf2011-09-23 21:17:56 -07002532 return NO_ERROR;
2533 }
2534
Steve Block6807e592011-10-20 11:56:00 +01002535 ALOGV("readBlob: read from ashmem");
Jeff Brown13b16042014-11-11 16:44:25 -08002536 bool isMutable = (blobType == BLOB_ASHMEM_MUTABLE);
Jeff Brown5707dbf2011-09-23 21:17:56 -07002537 int fd = readFileDescriptor();
2538 if (fd == int(BAD_TYPE)) return BAD_VALUE;
2539
Jorim Jaggi150b4ef2018-07-13 11:18:30 +00002540 if (!ashmem_valid(fd)) {
2541 ALOGE("invalid fd");
2542 return BAD_VALUE;
2543 }
Marco Nelissen7a96ec42018-06-06 07:37:46 -07002544 int size = ashmem_get_size_region(fd);
2545 if (size < 0 || size_t(size) < len) {
Jorim Jaggi150b4ef2018-07-13 11:18:30 +00002546 ALOGE("request size %zu does not match fd size %d", len, size);
Marco Nelissen7a96ec42018-06-06 07:37:46 -07002547 return BAD_VALUE;
2548 }
Yi Kong91635562018-06-07 14:38:36 -07002549 void* ptr = ::mmap(nullptr, len, isMutable ? PROT_READ | PROT_WRITE : PROT_READ,
Jeff Brown13b16042014-11-11 16:44:25 -08002550 MAP_SHARED, fd, 0);
Narayan Kamath9ea09752014-10-08 17:35:45 +01002551 if (ptr == MAP_FAILED) return NO_MEMORY;
Jeff Brown5707dbf2011-09-23 21:17:56 -07002552
Jeff Brown13b16042014-11-11 16:44:25 -08002553 outBlob->init(fd, ptr, len, isMutable);
Jeff Brown5707dbf2011-09-23 21:17:56 -07002554 return NO_ERROR;
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00002555#endif
Jeff Brown5707dbf2011-09-23 21:17:56 -07002556}
2557
Mathias Agopiane1424282013-07-29 21:24:40 -07002558status_t Parcel::read(FlattenableHelperInterface& val) const
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002559{
2560 // size
2561 const size_t len = this->readInt32();
2562 const size_t fd_count = this->readInt32();
2563
Andrei Homescu1519b982022-06-09 02:04:44 +00002564 if ((len > INT32_MAX) || (fd_count > kMaxFds)) {
Nick Kralevichb6b14232015-04-02 09:36:02 -07002565 // don't accept size_t values which may have come from an
2566 // inadvertent conversion from a negative int.
2567 return BAD_VALUE;
2568 }
2569
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002570 // payload
Nick Kralevichb6b14232015-04-02 09:36:02 -07002571 void const* const buf = this->readInplace(pad_size(len));
Yi Kong91635562018-06-07 14:38:36 -07002572 if (buf == nullptr)
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002573 return BAD_VALUE;
2574
Yi Kong91635562018-06-07 14:38:36 -07002575 int* fds = nullptr;
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002576 if (fd_count) {
Christopher Tatee4e0ae82016-03-24 16:03:44 -07002577 fds = new (std::nothrow) int[fd_count];
2578 if (fds == nullptr) {
2579 ALOGE("read: failed to allocate requested %zu fds", fd_count);
2580 return BAD_VALUE;
2581 }
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002582 }
2583
2584 status_t err = NO_ERROR;
2585 for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
Fabien Sanglardd84ff312016-10-21 10:58:26 -07002586 int fd = this->readFileDescriptor();
Nick Kralevichec9ec7d2016-12-17 19:47:27 -08002587 if (fd < 0 || ((fds[i] = fcntl(fd, F_DUPFD_CLOEXEC, 0)) < 0)) {
Jun Jiangabf8a2c2014-04-29 14:22:10 +08002588 err = BAD_VALUE;
Nick Kralevichec9ec7d2016-12-17 19:47:27 -08002589 ALOGE("fcntl(F_DUPFD_CLOEXEC) failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
Fabien Sanglardd84ff312016-10-21 10:58:26 -07002590 i, fds[i], fd_count, strerror(fd < 0 ? -fd : errno));
2591 // Close all the file descriptors that were dup-ed.
2592 for (size_t j=0; j<i ;j++) {
2593 close(fds[j]);
2594 }
Jun Jiangabf8a2c2014-04-29 14:22:10 +08002595 }
Mathias Agopian98e71dd2010-02-11 17:30:52 -08002596 }
2597
2598 if (err == NO_ERROR) {
2599 err = val.unflatten(buf, len, fds, fd_count);
2600 }
2601
2602 if (fd_count) {
2603 delete [] fds;
2604 }
2605
2606 return err;
2607}
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002608
2609#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002610const flat_binder_object* Parcel::readObject(bool nullMetaData) const
2611{
Frederick Mayled3c595a2022-05-09 23:02:54 +00002612 const auto* kernelFields = maybeKernelFields();
2613 if (kernelFields == nullptr) {
2614 return nullptr;
2615 }
2616
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002617 const size_t DPOS = mDataPos;
2618 if ((DPOS+sizeof(flat_binder_object)) <= mDataSize) {
2619 const flat_binder_object* obj
2620 = reinterpret_cast<const flat_binder_object*>(mData+DPOS);
2621 mDataPos = DPOS + sizeof(flat_binder_object);
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002622 if (!nullMetaData && (obj->cookie == 0 && obj->binder == 0)) {
The Android Open Source Project5f78a482009-01-20 14:03:58 -08002623 // When transferring a NULL object, we don't write it into
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002624 // the object list, so we don't want to check for it when
2625 // reading.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002626 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002627 return obj;
2628 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002629
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002630 // Ensure that this object is valid...
Frederick Mayled3c595a2022-05-09 23:02:54 +00002631 binder_size_t* const OBJS = kernelFields->mObjects;
2632 const size_t N = kernelFields->mObjectsSize;
2633 size_t opos = kernelFields->mNextObjectHint;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002634
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002635 if (N > 0) {
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002636 ALOGV("Parcel %p looking for obj at %zu, hint=%zu",
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002637 this, DPOS, opos);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002638
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002639 // Start at the current hint position, looking for an object at
2640 // the current data position.
2641 if (opos < N) {
2642 while (opos < (N-1) && OBJS[opos] < DPOS) {
2643 opos++;
2644 }
2645 } else {
2646 opos = N-1;
2647 }
2648 if (OBJS[opos] == DPOS) {
2649 // Found it!
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002650 ALOGV("Parcel %p found obj %zu at index %zu with forward search",
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002651 this, DPOS, opos);
Frederick Mayled3c595a2022-05-09 23:02:54 +00002652 kernelFields->mNextObjectHint = opos + 1;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002653 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002654 return obj;
2655 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002656
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002657 // Look backwards for it...
2658 while (opos > 0 && OBJS[opos] > DPOS) {
2659 opos--;
2660 }
2661 if (OBJS[opos] == DPOS) {
2662 // Found it!
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002663 ALOGV("Parcel %p found obj %zu at index %zu with backward search",
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002664 this, DPOS, opos);
Frederick Mayled3c595a2022-05-09 23:02:54 +00002665 kernelFields->mNextObjectHint = opos + 1;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002666 ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002667 return obj;
2668 }
2669 }
Steven Moreland3a667492023-06-02 21:41:39 +00002670 if (!mServiceFuzzing) {
2671 ALOGW("Attempt to read object from Parcel %p at offset %zu that is not in the object "
2672 "list",
2673 this, DPOS);
2674 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002675 }
Yi Kong91635562018-06-07 14:38:36 -07002676 return nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002677}
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002678#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002679
Frederick Mayled3c595a2022-05-09 23:02:54 +00002680void Parcel::closeFileDescriptors() {
Frederick Mayle69a0c992022-05-26 20:38:39 +00002681 if (auto* kernelFields = maybeKernelFields()) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002682#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +00002683 size_t i = kernelFields->mObjectsSize;
2684 if (i > 0) {
2685 // ALOGI("Closing file descriptors for %zu objects...", i);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002686 }
Frederick Mayle69a0c992022-05-26 20:38:39 +00002687 while (i > 0) {
2688 i--;
2689 const flat_binder_object* flat =
2690 reinterpret_cast<flat_binder_object*>(mData + kernelFields->mObjects[i]);
2691 if (flat->hdr.type == BINDER_TYPE_FD) {
2692 // ALOGI("Closing fd: %ld", flat->handle);
Steven Moreland02f736f2023-06-22 23:03:57 +00002693 // FDs from the kernel are always owned
2694 FdTagClose(flat->handle, this);
Frederick Mayle69a0c992022-05-26 20:38:39 +00002695 }
2696 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002697#else // BINDER_WITH_KERNEL_IPC
2698 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
Per Larsen202895c2025-01-15 03:11:20 +00002699 (void)kernelFields;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002700#endif // BINDER_WITH_KERNEL_IPC
Frederick Mayle69a0c992022-05-26 20:38:39 +00002701 } else if (auto* rpcFields = maybeRpcFields()) {
2702 rpcFields->mFds.reset();
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002703 }
2704}
2705
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002706uintptr_t Parcel::ipcData() const
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002707{
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002708 return reinterpret_cast<uintptr_t>(mData);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002709}
2710
2711size_t Parcel::ipcDataSize() const
2712{
2713 return (mDataSize > mDataPos ? mDataSize : mDataPos);
2714}
2715
Arve Hjønnevåg84e625a2014-01-28 20:12:59 -08002716uintptr_t Parcel::ipcObjects() const
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002717{
Frederick Mayled3c595a2022-05-09 23:02:54 +00002718 if (const auto* kernelFields = maybeKernelFields()) {
2719 return reinterpret_cast<uintptr_t>(kernelFields->mObjects);
2720 }
2721 return 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002722}
2723
2724size_t Parcel::ipcObjectsCount() const
2725{
Frederick Mayled3c595a2022-05-09 23:02:54 +00002726 if (const auto* kernelFields = maybeKernelFields()) {
2727 return kernelFields->mObjectsSize;
2728 }
2729 return 0;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002730}
2731
Frederick Mayled3c595a2022-05-09 23:02:54 +00002732void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, const binder_size_t* objects,
2733 size_t objectsCount, release_func relFunc) {
Steven Moreland438cce82021-04-02 18:04:08 +00002734 // this code uses 'mOwner == nullptr' to understand whether it owns memory
2735 LOG_ALWAYS_FATAL_IF(relFunc == nullptr, "must provide cleanup function");
2736
Steven Morelandceed9bb2020-12-17 01:01:06 +00002737 freeData();
2738
Frederick Mayled3c595a2022-05-09 23:02:54 +00002739 auto* kernelFields = maybeKernelFields();
2740 LOG_ALWAYS_FATAL_IF(kernelFields == nullptr); // guaranteed by freeData.
2741
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002742 mData = const_cast<uint8_t*>(data);
2743 mDataSize = mDataCapacity = dataSize;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002744 kernelFields->mObjects = const_cast<binder_size_t*>(objects);
2745 kernelFields->mObjectsSize = kernelFields->mObjectsCapacity = objectsCount;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002746 mOwner = relFunc;
Steven Morelandceed9bb2020-12-17 01:01:06 +00002747
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002748#ifdef BINDER_WITH_KERNEL_IPC
Steven Morelandceed9bb2020-12-17 01:01:06 +00002749 binder_size_t minOffset = 0;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002750 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
2751 binder_size_t offset = kernelFields->mObjects[i];
Arve Hjønnevågf50b9ea2014-02-13 19:22:08 -08002752 if (offset < minOffset) {
Dan Albert3bdc5b82014-11-20 11:50:23 -08002753 ALOGE("%s: bad object offset %" PRIu64 " < %" PRIu64 "\n",
Arve Hjønnevåg6f286112014-02-19 20:42:13 -08002754 __func__, (uint64_t)offset, (uint64_t)minOffset);
Frederick Mayled3c595a2022-05-09 23:02:54 +00002755 kernelFields->mObjectsSize = 0;
Arve Hjønnevågf50b9ea2014-02-13 19:22:08 -08002756 break;
2757 }
Martijn Coenen82c75312019-07-24 15:18:30 +02002758 const flat_binder_object* flat
2759 = reinterpret_cast<const flat_binder_object*>(mData + offset);
2760 uint32_t type = flat->hdr.type;
2761 if (!(type == BINDER_TYPE_BINDER || type == BINDER_TYPE_HANDLE ||
2762 type == BINDER_TYPE_FD)) {
2763 // We should never receive other types (eg BINDER_TYPE_FDA) as long as we don't support
2764 // them in libbinder. If we do receive them, it probably means a kernel bug; try to
Steven Morelandf2e0a952021-11-01 18:17:23 -07002765 // recover gracefully by clearing out the objects.
Martijn Coenen82c75312019-07-24 15:18:30 +02002766 android_errorWriteLog(0x534e4554, "135930648");
Steven Morelandf2e0a952021-11-01 18:17:23 -07002767 android_errorWriteLog(0x534e4554, "203847542");
Martijn Coenen82c75312019-07-24 15:18:30 +02002768 ALOGE("%s: unsupported type object (%" PRIu32 ") at offset %" PRIu64 "\n",
2769 __func__, type, (uint64_t)offset);
Steven Morelandf2e0a952021-11-01 18:17:23 -07002770
2771 // WARNING: callers of ipcSetDataReference need to make sure they
2772 // don't rely on mObjectsSize in their release_func.
Frederick Mayled3c595a2022-05-09 23:02:54 +00002773 kernelFields->mObjectsSize = 0;
Martijn Coenen82c75312019-07-24 15:18:30 +02002774 break;
2775 }
Steven Moreland02f736f2023-06-22 23:03:57 +00002776 if (type == BINDER_TYPE_FD) {
2777 // FDs from the kernel are always owned
Tomasz Wasilczyke97f3a82024-04-30 10:37:32 -07002778 FdTag(flat->handle, nullptr, this);
Steven Moreland02f736f2023-06-22 23:03:57 +00002779 }
Arve Hjønnevågf50b9ea2014-02-13 19:22:08 -08002780 minOffset = offset + sizeof(flat_binder_object);
2781 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002782 scanForFds();
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002783#else // BINDER_WITH_KERNEL_IPC
2784 LOG_ALWAYS_FATAL_IF(objectsCount != 0,
2785 "Non-zero objects count passed to Parcel with kernel driver disabled");
2786#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002787}
2788
Frederick Mayleffe9ac22022-06-30 02:07:36 +00002789status_t Parcel::rpcSetDataReference(
2790 const sp<RpcSession>& session, const uint8_t* data, size_t dataSize,
2791 const uint32_t* objectTable, size_t objectTableSize,
Tomasz Wasilczyk639490b2023-11-01 13:49:41 -07002792 std::vector<std::variant<unique_fd, borrowed_fd>>&& ancillaryFds, release_func relFunc) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00002793 // this code uses 'mOwner == nullptr' to understand whether it owns memory
2794 LOG_ALWAYS_FATAL_IF(relFunc == nullptr, "must provide cleanup function");
2795
2796 LOG_ALWAYS_FATAL_IF(session == nullptr);
2797
Frederick Mayle694e9732022-07-15 00:24:58 +00002798 if (objectTableSize != ancillaryFds.size()) {
2799 ALOGE("objectTableSize=%zu ancillaryFds.size=%zu", objectTableSize, ancillaryFds.size());
2800 relFunc(data, dataSize, nullptr, 0);
2801 return BAD_VALUE;
2802 }
2803 for (size_t i = 0; i < objectTableSize; i++) {
2804 uint32_t minObjectEnd;
2805 if (__builtin_add_overflow(objectTable[i], sizeof(RpcFields::ObjectType), &minObjectEnd) ||
2806 minObjectEnd >= dataSize) {
2807 ALOGE("received out of range object position: %" PRIu32 " (parcel size is %zu)",
2808 objectTable[i], dataSize);
2809 relFunc(data, dataSize, nullptr, 0);
2810 return BAD_VALUE;
2811 }
2812 }
2813
Frederick Mayled3c595a2022-05-09 23:02:54 +00002814 freeData();
2815 markForRpc(session);
2816
Frederick Mayle69a0c992022-05-26 20:38:39 +00002817 auto* rpcFields = maybeRpcFields();
2818 LOG_ALWAYS_FATAL_IF(rpcFields == nullptr); // guaranteed by markForRpc.
2819
Frederick Mayled3c595a2022-05-09 23:02:54 +00002820 mData = const_cast<uint8_t*>(data);
2821 mDataSize = mDataCapacity = dataSize;
2822 mOwner = relFunc;
Frederick Mayle69a0c992022-05-26 20:38:39 +00002823
Frederick Mayle69a0c992022-05-26 20:38:39 +00002824 rpcFields->mObjectPositions.reserve(objectTableSize);
2825 for (size_t i = 0; i < objectTableSize; i++) {
2826 rpcFields->mObjectPositions.push_back(objectTable[i]);
2827 }
2828 if (!ancillaryFds.empty()) {
2829 rpcFields->mFds = std::make_unique<decltype(rpcFields->mFds)::element_type>();
Frederick Mayleffe9ac22022-06-30 02:07:36 +00002830 *rpcFields->mFds = std::move(ancillaryFds);
Frederick Mayle69a0c992022-05-26 20:38:39 +00002831 }
2832
2833 return OK;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002834}
2835
Pawan Wagh7063b522022-09-28 18:52:26 +00002836void Parcel::print(std::ostream& to, uint32_t /*flags*/) const {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002837 to << "Parcel(";
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002838
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002839 if (errorCheck() != NO_ERROR) {
2840 const status_t err = errorCheck();
Colin Cross6f4f3ab2014-02-05 17:42:44 -08002841 to << "Error: " << (void*)(intptr_t)err << " \"" << strerror(-err) << "\"";
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002842 } else if (dataSize() > 0) {
2843 const uint8_t* DATA = data();
Pawan Wagh7063b522022-09-28 18:52:26 +00002844 to << "\t" << HexDump(DATA, dataSize());
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002845#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayled3c595a2022-05-09 23:02:54 +00002846 if (const auto* kernelFields = maybeKernelFields()) {
2847 const binder_size_t* OBJS = kernelFields->mObjects;
2848 const size_t N = objectsCount();
2849 for (size_t i = 0; i < N; i++) {
2850 const flat_binder_object* flat =
2851 reinterpret_cast<const flat_binder_object*>(DATA + OBJS[i]);
Pawan Wagh7063b522022-09-28 18:52:26 +00002852 to << "Object #" << i << " @ " << (void*)OBJS[i] << ": "
Frederick Mayled3c595a2022-05-09 23:02:54 +00002853 << TypeCode(flat->hdr.type & 0x7f7f7f00) << " = " << flat->binder;
2854 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002855 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002856#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002857 } else {
2858 to << "NULL";
2859 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002860
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002861 to << ")";
2862}
2863
2864void Parcel::releaseObjects()
2865{
Frederick Mayled3c595a2022-05-09 23:02:54 +00002866 auto* kernelFields = maybeKernelFields();
2867 if (kernelFields == nullptr) {
2868 return;
2869 }
2870
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002871#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayled3c595a2022-05-09 23:02:54 +00002872 size_t i = kernelFields->mObjectsSize;
Martijn Coenen69390d42018-10-22 15:18:10 +02002873 if (i == 0) {
2874 return;
2875 }
2876 sp<ProcessState> proc(ProcessState::self());
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002877 uint8_t* const data = mData;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002878 binder_size_t* const objects = kernelFields->mObjects;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002879 while (i > 0) {
2880 i--;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002881 const flat_binder_object* flat = reinterpret_cast<flat_binder_object*>(data + objects[i]);
Steven Morelandc673f1f2021-10-07 18:23:35 -07002882 release_object(proc, *flat, this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002883 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002884#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002885}
2886
2887void Parcel::acquireObjects()
2888{
Frederick Mayled3c595a2022-05-09 23:02:54 +00002889 auto* kernelFields = maybeKernelFields();
2890 if (kernelFields == nullptr) {
2891 return;
2892 }
2893
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002894#ifdef BINDER_WITH_KERNEL_IPC
Frederick Mayled3c595a2022-05-09 23:02:54 +00002895 size_t i = kernelFields->mObjectsSize;
Martijn Coenen69390d42018-10-22 15:18:10 +02002896 if (i == 0) {
2897 return;
2898 }
2899 const sp<ProcessState> proc(ProcessState::self());
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002900 uint8_t* const data = mData;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002901 binder_size_t* const objects = kernelFields->mObjects;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002902 while (i > 0) {
2903 i--;
Frederick Mayled3c595a2022-05-09 23:02:54 +00002904 const flat_binder_object* flat = reinterpret_cast<flat_binder_object*>(data + objects[i]);
Steven Morelandc673f1f2021-10-07 18:23:35 -07002905 acquire_object(proc, *flat, this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002906 }
Andrei Homescua9cca9c2022-05-03 04:48:01 +00002907#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002908}
2909
2910void Parcel::freeData()
2911{
2912 freeDataNoInit();
2913 initState();
2914}
2915
2916void Parcel::freeDataNoInit()
2917{
2918 if (mOwner) {
Dianne Hackborn7e790af2014-11-11 12:22:53 -08002919 LOG_ALLOC("Parcel %p: freeing other owner data", this);
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002920 //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
Frederick Mayled3c595a2022-05-09 23:02:54 +00002921 auto* kernelFields = maybeKernelFields();
Frederick Mayle53b6ffe2022-07-15 20:14:01 +00002922 // Close FDs before freeing, otherwise they will leak for kernel binder.
2923 closeFileDescriptors();
2924 mOwner(mData, mDataSize, kernelFields ? kernelFields->mObjects : nullptr,
Frederick Mayled3c595a2022-05-09 23:02:54 +00002925 kernelFields ? kernelFields->mObjectsSize : 0);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002926 } else {
Dianne Hackborn7e790af2014-11-11 12:22:53 -08002927 LOG_ALLOC("Parcel %p: freeing allocated data", this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002928 releaseObjects();
Dianne Hackborn7e790af2014-11-11 12:22:53 -08002929 if (mData) {
2930 LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);
Jeff Sharkey8994c182020-09-11 12:07:10 -06002931 gParcelGlobalAllocSize -= mDataCapacity;
2932 gParcelGlobalAllocCount--;
Steven Morelandf183fdd2020-10-27 00:12:12 +00002933 if (mDeallocZero) {
2934 zeroMemory(mData, mDataSize);
2935 }
Dianne Hackborn7e790af2014-11-11 12:22:53 -08002936 free(mData);
2937 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00002938 auto* kernelFields = maybeKernelFields();
2939 if (kernelFields && kernelFields->mObjects) free(kernelFields->mObjects);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002940 }
2941}
2942
2943status_t Parcel::growData(size_t len)
2944{
Nick Kralevichb6b14232015-04-02 09:36:02 -07002945 if (len > INT32_MAX) {
2946 // don't accept size_t values which may have come from an
2947 // inadvertent conversion from a negative int.
2948 return BAD_VALUE;
2949 }
2950
Martijn Coenen93fe5182020-01-22 10:46:25 +01002951 if (len > SIZE_MAX - mDataSize) return NO_MEMORY; // overflow
2952 if (mDataSize + len > SIZE_MAX / 3) return NO_MEMORY; // overflow
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002953 size_t newSize = ((mDataSize+len)*3)/2;
2954 return (newSize <= mDataSize)
2955 ? (status_t) NO_MEMORY
Steven Moreland042ae822020-05-27 17:45:17 +00002956 : continueWrite(std::max(newSize, (size_t) 128));
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002957}
2958
Steven Morelandf183fdd2020-10-27 00:12:12 +00002959static uint8_t* reallocZeroFree(uint8_t* data, size_t oldCapacity, size_t newCapacity, bool zero) {
2960 if (!zero) {
2961 return (uint8_t*)realloc(data, newCapacity);
2962 }
2963 uint8_t* newData = (uint8_t*)malloc(newCapacity);
2964 if (!newData) {
2965 return nullptr;
2966 }
2967
2968 memcpy(newData, data, std::min(oldCapacity, newCapacity));
2969 zeroMemory(data, oldCapacity);
2970 free(data);
2971 return newData;
2972}
2973
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002974status_t Parcel::restartWrite(size_t desired)
2975{
Nick Kralevichb6b14232015-04-02 09:36:02 -07002976 if (desired > INT32_MAX) {
2977 // don't accept size_t values which may have come from an
2978 // inadvertent conversion from a negative int.
2979 return BAD_VALUE;
2980 }
2981
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002982 if (mOwner) {
2983 freeData();
2984 return continueWrite(desired);
2985 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002986
Steven Morelandc6b0dfa2024-03-05 09:10:02 +00002987 releaseObjects();
2988
Steven Morelandf183fdd2020-10-27 00:12:12 +00002989 uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002990 if (!data && desired > mDataCapacity) {
Steven Moreland47d7f1e2024-03-08 23:43:21 +00002991 LOG_ALWAYS_FATAL("out of memory");
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07002992 mError = NO_MEMORY;
2993 return NO_MEMORY;
2994 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07002995
Devin Moore4a0a55e2020-06-04 13:23:10 -07002996 if (data || desired == 0) {
Dianne Hackborn7e790af2014-11-11 12:22:53 -08002997 LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired);
Jeff Sharkey8994c182020-09-11 12:07:10 -06002998 if (mDataCapacity > desired) {
2999 gParcelGlobalAllocSize -= (mDataCapacity - desired);
3000 } else {
3001 gParcelGlobalAllocSize += (desired - mDataCapacity);
3002 }
3003
Colin Cross83ec65e2015-12-08 17:15:50 -08003004 if (!mData) {
3005 gParcelGlobalAllocCount++;
3006 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003007 mData = data;
3008 mDataCapacity = desired;
3009 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003010
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003011 mDataSize = mDataPos = 0;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003012 ALOGV("restartWrite Setting data size of %p to %zu", this, mDataSize);
3013 ALOGV("restartWrite Setting data pos of %p to %zu", this, mDataPos);
3014
Frederick Mayled3c595a2022-05-09 23:02:54 +00003015 if (auto* kernelFields = maybeKernelFields()) {
3016 free(kernelFields->mObjects);
3017 kernelFields->mObjects = nullptr;
3018 kernelFields->mObjectsSize = kernelFields->mObjectsCapacity = 0;
3019 kernelFields->mNextObjectHint = 0;
3020 kernelFields->mObjectsSorted = false;
3021 kernelFields->mHasFds = false;
3022 kernelFields->mFdsKnown = true;
Frederick Mayle69a0c992022-05-26 20:38:39 +00003023 } else if (auto* rpcFields = maybeRpcFields()) {
3024 rpcFields->mObjectPositions.clear();
3025 rpcFields->mFds.reset();
Frederick Mayled3c595a2022-05-09 23:02:54 +00003026 }
Dianne Hackborn8938ed22011-09-28 23:19:47 -04003027 mAllowFds = true;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003028
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003029 return NO_ERROR;
3030}
3031
3032status_t Parcel::continueWrite(size_t desired)
3033{
Nick Kralevichb6b14232015-04-02 09:36:02 -07003034 if (desired > INT32_MAX) {
3035 // don't accept size_t values which may have come from an
3036 // inadvertent conversion from a negative int.
3037 return BAD_VALUE;
3038 }
3039
Frederick Mayled3c595a2022-05-09 23:02:54 +00003040 auto* kernelFields = maybeKernelFields();
Frederick Mayle69a0c992022-05-26 20:38:39 +00003041 auto* rpcFields = maybeRpcFields();
Frederick Mayled3c595a2022-05-09 23:02:54 +00003042
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003043 // If shrinking, first adjust for any objects that appear
3044 // after the new data size.
Frederick Mayle69a0c992022-05-26 20:38:39 +00003045 size_t objectsSize =
3046 kernelFields ? kernelFields->mObjectsSize : rpcFields->mObjectPositions.size();
3047 if (desired < mDataSize) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003048 if (desired == 0) {
3049 objectsSize = 0;
3050 } else {
Frederick Mayle69a0c992022-05-26 20:38:39 +00003051 if (kernelFields) {
3052 while (objectsSize > 0) {
3053 if (kernelFields->mObjects[objectsSize - 1] < desired) break;
3054 objectsSize--;
3055 }
3056 } else {
3057 while (objectsSize > 0) {
3058 if (rpcFields->mObjectPositions[objectsSize - 1] < desired) break;
3059 objectsSize--;
3060 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003061 }
3062 }
3063 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003064
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003065 if (mOwner) {
3066 // If the size is going to zero, just release the owner's data.
3067 if (desired == 0) {
3068 freeData();
3069 return NO_ERROR;
3070 }
3071
3072 // If there is a different owner, we need to take
3073 // posession.
3074 uint8_t* data = (uint8_t*)malloc(desired);
3075 if (!data) {
3076 mError = NO_MEMORY;
3077 return NO_MEMORY;
3078 }
Yi Kong91635562018-06-07 14:38:36 -07003079 binder_size_t* objects = nullptr;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003080
Frederick Mayle69a0c992022-05-26 20:38:39 +00003081 if (kernelFields && objectsSize) {
Nick Kraleviche9881a32015-04-28 16:21:30 -07003082 objects = (binder_size_t*)calloc(objectsSize, sizeof(binder_size_t));
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003083 if (!objects) {
Hyejin Kim3f727c02013-03-09 11:28:54 +09003084 free(data);
3085
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003086 mError = NO_MEMORY;
3087 return NO_MEMORY;
3088 }
3089
3090 // Little hack to only acquire references on objects
3091 // we will be keeping.
Frederick Mayled3c595a2022-05-09 23:02:54 +00003092 size_t oldObjectsSize = kernelFields->mObjectsSize;
3093 kernelFields->mObjectsSize = objectsSize;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003094 acquireObjects();
Frederick Mayled3c595a2022-05-09 23:02:54 +00003095 kernelFields->mObjectsSize = oldObjectsSize;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003096 }
Frederick Mayle69a0c992022-05-26 20:38:39 +00003097 if (rpcFields) {
3098 if (status_t status = truncateRpcObjects(objectsSize); status != OK) {
3099 free(data);
3100 return status;
3101 }
3102 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003103
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003104 if (mData) {
3105 memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
3106 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00003107 if (objects && kernelFields && kernelFields->mObjects) {
3108 memcpy(objects, kernelFields->mObjects, objectsSize * sizeof(binder_size_t));
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003109 }
Frederick Mayle53b6ffe2022-07-15 20:14:01 +00003110 // ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
3111 if (kernelFields) {
3112 // TODO(b/239222407): This seems wrong. We should only free FDs when
3113 // they are in a truncated section of the parcel.
3114 closeFileDescriptors();
3115 }
3116 mOwner(mData, mDataSize, kernelFields ? kernelFields->mObjects : nullptr,
Frederick Mayled3c595a2022-05-09 23:02:54 +00003117 kernelFields ? kernelFields->mObjectsSize : 0);
Yi Kong91635562018-06-07 14:38:36 -07003118 mOwner = nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003119
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003120 LOG_ALLOC("Parcel %p: taking ownership of %zu capacity", this, desired);
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003121 gParcelGlobalAllocSize += desired;
3122 gParcelGlobalAllocCount++;
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003123
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003124 mData = data;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003125 mDataSize = (mDataSize < desired) ? mDataSize : desired;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003126 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003127 mDataCapacity = desired;
Frederick Mayled3c595a2022-05-09 23:02:54 +00003128 if (kernelFields) {
3129 kernelFields->mObjects = objects;
3130 kernelFields->mObjectsSize = kernelFields->mObjectsCapacity = objectsSize;
3131 kernelFields->mNextObjectHint = 0;
3132 kernelFields->mObjectsSorted = false;
3133 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003134
3135 } else if (mData) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00003136 if (kernelFields && objectsSize < kernelFields->mObjectsSize) {
Andrei Homescua9cca9c2022-05-03 04:48:01 +00003137#ifdef BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003138 // Need to release refs on any objects we are dropping.
3139 const sp<ProcessState> proc(ProcessState::self());
Frederick Mayled3c595a2022-05-09 23:02:54 +00003140 for (size_t i = objectsSize; i < kernelFields->mObjectsSize; i++) {
3141 const flat_binder_object* flat =
3142 reinterpret_cast<flat_binder_object*>(mData + kernelFields->mObjects[i]);
Christopher Ferrisdbaa22a2017-07-27 10:38:45 -07003143 if (flat->hdr.type == BINDER_TYPE_FD) {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003144 // will need to rescan because we may have lopped off the only FDs
Frederick Mayled3c595a2022-05-09 23:02:54 +00003145 kernelFields->mFdsKnown = false;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003146 }
Steven Morelandc673f1f2021-10-07 18:23:35 -07003147 release_object(proc, *flat, this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003148 }
Michael Wachenschwanz6af27a82019-06-03 17:24:51 -07003149
3150 if (objectsSize == 0) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00003151 free(kernelFields->mObjects);
3152 kernelFields->mObjects = nullptr;
3153 kernelFields->mObjectsCapacity = 0;
Michael Wachenschwanz6af27a82019-06-03 17:24:51 -07003154 } else {
3155 binder_size_t* objects =
Frederick Mayled3c595a2022-05-09 23:02:54 +00003156 (binder_size_t*)realloc(kernelFields->mObjects,
3157 objectsSize * sizeof(binder_size_t));
Michael Wachenschwanz6af27a82019-06-03 17:24:51 -07003158 if (objects) {
Frederick Mayled3c595a2022-05-09 23:02:54 +00003159 kernelFields->mObjects = objects;
3160 kernelFields->mObjectsCapacity = objectsSize;
Michael Wachenschwanz6af27a82019-06-03 17:24:51 -07003161 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003162 }
Frederick Mayled3c595a2022-05-09 23:02:54 +00003163 kernelFields->mObjectsSize = objectsSize;
3164 kernelFields->mNextObjectHint = 0;
3165 kernelFields->mObjectsSorted = false;
Andrei Homescua9cca9c2022-05-03 04:48:01 +00003166#else // BINDER_WITH_KERNEL_IPC
3167 LOG_ALWAYS_FATAL("Non-zero numObjects for RPC Parcel");
3168#endif // BINDER_WITH_KERNEL_IPC
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003169 }
Frederick Mayle69a0c992022-05-26 20:38:39 +00003170 if (rpcFields) {
3171 if (status_t status = truncateRpcObjects(objectsSize); status != OK) {
3172 return status;
3173 }
3174 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003175
3176 // We own the data, so we can just do a realloc().
3177 if (desired > mDataCapacity) {
Steven Morelandf183fdd2020-10-27 00:12:12 +00003178 uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003179 if (data) {
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003180 LOG_ALLOC("Parcel %p: continue from %zu to %zu capacity", this, mDataCapacity,
3181 desired);
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003182 gParcelGlobalAllocSize += desired;
3183 gParcelGlobalAllocSize -= mDataCapacity;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003184 mData = data;
3185 mDataCapacity = desired;
Ganesh Mahendranade89892017-09-28 16:56:03 +08003186 } else {
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003187 mError = NO_MEMORY;
3188 return NO_MEMORY;
3189 }
3190 } else {
Dianne Hackborn97e2bcd2011-04-13 18:15:56 -07003191 if (mDataSize > desired) {
3192 mDataSize = desired;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003193 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
Dianne Hackborn97e2bcd2011-04-13 18:15:56 -07003194 }
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003195 if (mDataPos > desired) {
3196 mDataPos = desired;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003197 ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003198 }
3199 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003200
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003201 } else {
3202 // This is the first data. Easy!
3203 uint8_t* data = (uint8_t*)malloc(desired);
3204 if (!data) {
3205 mError = NO_MEMORY;
3206 return NO_MEMORY;
3207 }
Hyejin Kim3f727c02013-03-09 11:28:54 +09003208
Frederick Mayled3c595a2022-05-09 23:02:54 +00003209 if (!(mDataCapacity == 0 &&
3210 (kernelFields == nullptr ||
3211 (kernelFields->mObjects == nullptr && kernelFields->mObjectsCapacity == 0)))) {
3212 ALOGE("continueWrite: %zu/%p/%zu/%zu", mDataCapacity,
3213 kernelFields ? kernelFields->mObjects : nullptr,
3214 kernelFields ? kernelFields->mObjectsCapacity : 0, desired);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003215 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003216
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003217 LOG_ALLOC("Parcel %p: allocating with %zu capacity", this, desired);
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003218 gParcelGlobalAllocSize += desired;
3219 gParcelGlobalAllocCount++;
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003220
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003221 mData = data;
3222 mDataSize = mDataPos = 0;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003223 ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
3224 ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003225 mDataCapacity = desired;
3226 }
3227
3228 return NO_ERROR;
3229}
3230
Frederick Mayle69a0c992022-05-26 20:38:39 +00003231status_t Parcel::truncateRpcObjects(size_t newObjectsSize) {
3232 auto* rpcFields = maybeRpcFields();
3233 if (newObjectsSize == 0) {
3234 rpcFields->mObjectPositions.clear();
3235 if (rpcFields->mFds) {
3236 rpcFields->mFds->clear();
3237 }
3238 return OK;
3239 }
3240 while (rpcFields->mObjectPositions.size() > newObjectsSize) {
3241 uint32_t pos = rpcFields->mObjectPositions.back();
3242 rpcFields->mObjectPositions.pop_back();
3243 const auto type = *reinterpret_cast<const RpcFields::ObjectType*>(mData + pos);
3244 if (type == RpcFields::TYPE_NATIVE_FILE_DESCRIPTOR) {
3245 const auto fdIndex =
3246 *reinterpret_cast<const int32_t*>(mData + pos + sizeof(RpcFields::ObjectType));
3247 if (rpcFields->mFds == nullptr || fdIndex < 0 ||
3248 static_cast<size_t>(fdIndex) >= rpcFields->mFds->size()) {
3249 ALOGE("RPC Parcel contains invalid file descriptor index. index=%d fd_count=%zu",
3250 fdIndex, rpcFields->mFds ? rpcFields->mFds->size() : 0);
3251 return BAD_VALUE;
3252 }
3253 // In practice, this always removes the last element.
3254 rpcFields->mFds->erase(rpcFields->mFds->begin() + fdIndex);
3255 }
3256 }
3257 return OK;
3258}
3259
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003260void Parcel::initState()
3261{
Dianne Hackborn7e790af2014-11-11 12:22:53 -08003262 LOG_ALLOC("Parcel %p: initState", this);
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003263 mError = NO_ERROR;
Yi Kong91635562018-06-07 14:38:36 -07003264 mData = nullptr;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003265 mDataSize = 0;
3266 mDataCapacity = 0;
3267 mDataPos = 0;
Mark Salyzynd4ecccf2014-05-30 16:35:57 -07003268 ALOGV("initState Setting data size of %p to %zu", this, mDataSize);
3269 ALOGV("initState Setting data pos of %p to %zu", this, mDataPos);
Frederick Mayled3c595a2022-05-09 23:02:54 +00003270 mVariantFields.emplace<KernelFields>();
Steven Moreland6e5a7752019-08-05 20:30:14 -07003271 mAllowFds = true;
Steven Morelandf183fdd2020-10-27 00:12:12 +00003272 mDeallocZero = false;
Yi Kong91635562018-06-07 14:38:36 -07003273 mOwner = nullptr;
Pawan Wagh104654a2022-11-15 21:18:42 +00003274 mEnforceNoDataAvail = true;
Steven Moreland3a667492023-06-02 21:41:39 +00003275 mServiceFuzzing = false;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003276}
3277
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +01003278void Parcel::scanForFds() const {
Frederick Mayled3c595a2022-05-09 23:02:54 +00003279 auto* kernelFields = maybeKernelFields();
3280 if (kernelFields == nullptr) {
3281 return;
3282 }
3283 status_t status = hasFileDescriptorsInRange(0, dataSize(), &kernelFields->mHasFds);
Bernardo Rufinobbbd88d2021-10-15 14:54:30 +01003284 ALOGE_IF(status != NO_ERROR, "Error %d calling hasFileDescriptorsInRange()", status);
Frederick Mayled3c595a2022-05-09 23:02:54 +00003285 kernelFields->mFdsKnown = true;
The Android Open Source Project7c1b96a2008-10-21 07:00:00 -07003286}
3287
Andrei Homescua9cca9c2022-05-03 04:48:01 +00003288#ifdef BINDER_WITH_KERNEL_IPC
Adrian Rooscbf37262015-10-22 16:12:53 -07003289size_t Parcel::getOpenAshmemSize() const
3290{
Frederick Mayled3c595a2022-05-09 23:02:54 +00003291 auto* kernelFields = maybeKernelFields();
3292 if (kernelFields == nullptr) {
3293 return 0;
3294 }
3295
Steven Morelandc673f1f2021-10-07 18:23:35 -07003296 size_t openAshmemSize = 0;
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00003297#ifndef BINDER_DISABLE_BLOB
Frederick Mayled3c595a2022-05-09 23:02:54 +00003298 for (size_t i = 0; i < kernelFields->mObjectsSize; i++) {
Steven Morelandc673f1f2021-10-07 18:23:35 -07003299 const flat_binder_object* flat =
Frederick Mayled3c595a2022-05-09 23:02:54 +00003300 reinterpret_cast<const flat_binder_object*>(mData + kernelFields->mObjects[i]);
Steven Morelandc673f1f2021-10-07 18:23:35 -07003301
3302 // cookie is compared against zero for historical reasons
3303 // > obj.cookie = takeOwnership ? 1 : 0;
3304 if (flat->hdr.type == BINDER_TYPE_FD && flat->cookie != 0 && ashmem_valid(flat->handle)) {
3305 int size = ashmem_get_size_region(flat->handle);
3306 if (__builtin_add_overflow(openAshmemSize, size, &openAshmemSize)) {
3307 ALOGE("Overflow when computing ashmem size.");
3308 return SIZE_MAX;
3309 }
3310 }
3311 }
Tomasz Wasilczykbca8f942023-10-09 17:42:37 +00003312#endif
Steven Morelandc673f1f2021-10-07 18:23:35 -07003313 return openAshmemSize;
Dan Sandleraa5c2342015-04-10 10:08:45 -04003314}
Andrei Homescua9cca9c2022-05-03 04:48:01 +00003315#endif // BINDER_WITH_KERNEL_IPC
Dan Sandleraa5c2342015-04-10 10:08:45 -04003316
Jeff Brown5707dbf2011-09-23 21:17:56 -07003317// --- Parcel::Blob ---
3318
3319Parcel::Blob::Blob() :
Yi Kong91635562018-06-07 14:38:36 -07003320 mFd(-1), mData(nullptr), mSize(0), mMutable(false) {
Jeff Brown5707dbf2011-09-23 21:17:56 -07003321}
3322
3323Parcel::Blob::~Blob() {
3324 release();
3325}
3326
3327void Parcel::Blob::release() {
Jeff Brown13b16042014-11-11 16:44:25 -08003328 if (mFd != -1 && mData) {
Mike McTernan733610f2024-08-27 11:48:30 +01003329 if (::munmap(mData, mSize) == -1) {
3330 ALOGW("munmap() failed: %s", strerror(errno));
3331 }
Jeff Brown5707dbf2011-09-23 21:17:56 -07003332 }
3333 clear();
3334}
3335
Jeff Brown13b16042014-11-11 16:44:25 -08003336void Parcel::Blob::init(int fd, void* data, size_t size, bool isMutable) {
3337 mFd = fd;
Jeff Brown5707dbf2011-09-23 21:17:56 -07003338 mData = data;
3339 mSize = size;
Jeff Brown13b16042014-11-11 16:44:25 -08003340 mMutable = isMutable;
Jeff Brown5707dbf2011-09-23 21:17:56 -07003341}
3342
3343void Parcel::Blob::clear() {
Jeff Brown13b16042014-11-11 16:44:25 -08003344 mFd = -1;
Yi Kong91635562018-06-07 14:38:36 -07003345 mData = nullptr;
Jeff Brown5707dbf2011-09-23 21:17:56 -07003346 mSize = 0;
Jeff Brown13b16042014-11-11 16:44:25 -08003347 mMutable = false;
Jeff Brown5707dbf2011-09-23 21:17:56 -07003348}
3349
Steven Moreland61ff8492019-09-26 16:05:45 -07003350} // namespace android