commit 96c7eed596077ff84e75b7b1c6f20c3a29219bd1
author Eric Laurent <elaurent@google.com> Mon Mar 26 17:57:01 2018 -0700
committer Eric Laurent <elaurent@google.com> Tue Mar 27 14:49:16 2018 +0000
tree cf06852ef755e4d7dccfa81a7d3d4909d6159c60
parent bebc764c6b3e90024a56c9af4517a1a68713f3e7

audioserver: fix UID checks for multi user

Fix UID checks in audioserver to take into account multi user UIDs
where the top part above AID_USER_OFFSET contains the user number.

Bug: 76439650
Test: manual audio smoke tests.
Change-Id: I6dbd616021bcb2639c7b7369000ce911c7e7e030

media/libaudioclient/IAudioFlinger.cpp

diff --git a/media/libaudioclient/IAudioFlinger.cpp b/media/libaudioclient/IAudioFlinger.cpp
index 873d836..a20f1f2 100644
--- a/media/libaudioclient/IAudioFlinger.cpp
+++ b/media/libaudioclient/IAudioFlinger.cpp
@@ -903,13 +903,15 @@
         case SET_MODE:
         case SET_MIC_MUTE:
         case SET_LOW_RAM_DEVICE:
-        case SYSTEM_READY:
-            if (IPCThreadState::self()->getCallingUid() >= AID_APP_START) {
+        case SYSTEM_READY: {
+            uid_t multiUserClientUid = IPCThreadState::self()->getCallingUid() % AID_USER_OFFSET;
+            if (multiUserClientUid >= AID_APP_START) {
                 ALOGW("%s: transaction %d received from PID %d unauthorized UID %d",
                       __func__, code, IPCThreadState::self()->getCallingPid(),
                       IPCThreadState::self()->getCallingUid());
                 return INVALID_OPERATION;
             }
+        } break;
         default:
             break;
     }