commit 96c7eed596077ff84e75b7b1c6f20c3a29219bd1
author Eric Laurent <elaurent@google.com> Mon Mar 26 17:57:01 2018 -0700
committer Eric Laurent <elaurent@google.com> Tue Mar 27 14:49:16 2018 +0000
tree cf06852ef755e4d7dccfa81a7d3d4909d6159c60
parent bebc764c6b3e90024a56c9af4517a1a68713f3e7

audioserver: fix UID checks for multi user

Fix UID checks in audioserver to take into account multi user UIDs
where the top part above AID_USER_OFFSET contains the user number.

Bug: 76439650
Test: manual audio smoke tests.
Change-Id: I6dbd616021bcb2639c7b7369000ce911c7e7e030

media/libaudioclient/IAudioFlinger.cpp

diff --git a/media/libaudioclient/IAudioFlinger.cpp b/media/libaudioclient/IAudioFlinger.cpp
index 873d836..a20f1f2 100644
--- a/media/libaudioclient/IAudioFlinger.cpp
+++ b/media/libaudioclient/IAudioFlinger.cpp
@@ -903,13 +903,15 @@
         case SET_MODE:
         case SET_MIC_MUTE:
         case SET_LOW_RAM_DEVICE:
-        case SYSTEM_READY:
-            if (IPCThreadState::self()->getCallingUid() >= AID_APP_START) {
+        case SYSTEM_READY: {
+            uid_t multiUserClientUid = IPCThreadState::self()->getCallingUid() % AID_USER_OFFSET;
+            if (multiUserClientUid >= AID_APP_START) {
                 ALOGW("%s: transaction %d received from PID %d unauthorized UID %d",
                       __func__, code, IPCThreadState::self()->getCallingPid(),
                       IPCThreadState::self()->getCallingUid());
                 return INVALID_OPERATION;
             }
+        } break;
         default:
             break;
     }

media/libaudioclient/IAudioPolicyService.cpp

diff --git a/media/libaudioclient/IAudioPolicyService.cpp b/media/libaudioclient/IAudioPolicyService.cpp
index 0b98502..c0d5388 100644
--- a/media/libaudioclient/IAudioPolicyService.cpp
+++ b/media/libaudioclient/IAudioPolicyService.cpp
@@ -872,13 +872,15 @@
         case INIT_STREAM_VOLUME:
         case SET_STREAM_VOLUME:
         case REGISTER_POLICY_MIXES:
-        case SET_MASTER_MONO:
-            if (IPCThreadState::self()->getCallingUid() >= AID_APP_START) {
+        case SET_MASTER_MONO: {
+            uid_t multiUserClientUid = IPCThreadState::self()->getCallingUid() % AID_USER_OFFSET;
+            if (multiUserClientUid >= AID_APP_START) {
                 ALOGW("%s: transaction %d received from PID %d unauthorized UID %d",
                       __func__, code, IPCThreadState::self()->getCallingPid(),
                       IPCThreadState::self()->getCallingUid());
                 return INVALID_OPERATION;
             }
+        } break;
         default:
             break;
     }

services/audiopolicy/service/AudioPolicyService.cpp

diff --git a/services/audiopolicy/service/AudioPolicyService.cpp b/services/audiopolicy/service/AudioPolicyService.cpp
index 90a5a0f..5d90408 100644
--- a/services/audiopolicy/service/AudioPolicyService.cpp
+++ b/services/audiopolicy/service/AudioPolicyService.cpp
@@ -273,7 +273,7 @@
 void AudioPolicyService::NotificationClient::onDynamicPolicyMixStateUpdate(
         const String8& regId, int32_t state)
 {
-    if (mAudioPolicyServiceClient != 0 && mUid < AID_APP_START) {
+    if (mAudioPolicyServiceClient != 0 && (mUid % AID_USER_OFFSET) < AID_APP_START) {
         mAudioPolicyServiceClient->onDynamicPolicyMixStateUpdate(regId, state);
     }
 }
@@ -283,7 +283,7 @@
         const audio_config_base_t *clientConfig, const audio_config_base_t *deviceConfig,
         audio_patch_handle_t patchHandle)
 {
-    if (mAudioPolicyServiceClient != 0 && mUid < AID_APP_START) {
+    if (mAudioPolicyServiceClient != 0 && (mUid % AID_USER_OFFSET) < AID_APP_START) {
         mAudioPolicyServiceClient->onRecordingConfigurationUpdate(event, clientInfo,
                 clientConfig, deviceConfig, patchHandle);
     }