Skip to content

Commit 3db28ad

Browse files
AlamIntelsysopenci
authored andcommitted
ASB JUN 2025 Security Patches integration
Integrating_ Google Android Security Bulletin Patches. Test done: STS r39 TCs Passed Tracked-On: OAM-132951 Signed-off-by: Alam, SahibeX <sahibex.alam@intel.com>
1 parent 4b3322c commit 3db28ad

17 files changed

Lines changed: 2238 additions & 1 deletion

aosp_diff/preliminary/art/0008-Ensure-the-dex-use-database-cannot-grow-unboundedly.patch

Lines changed: 395 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
From 5f480e67a165223165eb45cb4893902d4d2fcdf1 Mon Sep 17 00:00:00 2001
2+
From: Jiakai Zhang <jiakaiz@google.com>
3+
Date: Tue, 25 Mar 2025 08:33:34 -0700
4+
Subject: [PATCH] Fix SELinux denial on GMS Core's symlinks to secondary dex
5+
files.
6+
7+
Bug: 401662336
8+
Bug: 391895923
9+
Test: Presubmit
10+
Flag: EXEMPT bugfix
11+
(cherry picked from commit abeeacd902042cb2e4941ad66608f8bc526613d4)
12+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5dabc78c06b506e6b247d557157f4ab05147082b)
13+
Merged-In: Iaa9a716cfe262897e313b994db92855721e1dfcc
14+
Change-Id: Iaa9a716cfe262897e313b994db92855721e1dfcc
15+
---
16+
.../com/android/server/art/DexUseManagerLocal.java | 13 ++++++++-----
17+
1 file changed, 8 insertions(+), 5 deletions(-)
18+
19+
diff --git a/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java b/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
20+
index c154cd0402..b7b42caeed 100644
21+
--- a/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
22+
+++ b/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
23+
@@ -67,6 +67,7 @@ import java.io.OutputStream;
24+
import java.lang.annotation.Retention;
25+
import java.lang.annotation.RetentionPolicy;
26+
import java.nio.file.Files;
27+
+import java.nio.file.LinkOption;
28+
import java.nio.file.StandardCopyOption;
29+
import java.util.ArrayList;
30+
import java.util.Collections;
31+
@@ -116,10 +117,8 @@ public class DexUseManagerLocal {
32+
// Impose a limit on the input accepted by notifyDexContainersLoaded per owning package.
33+
/** @hide */
34+
@VisibleForTesting public static final int MAX_PATH_LENGTH = 4096;
35+
-
36+
/** @hide */
37+
@VisibleForTesting public static final int MAX_CLASS_LOADER_CONTEXT_LENGTH = 10000;
38+
-
39+
/** @hide */
40+
private static final int MAX_SECONDARY_DEX_FILES_PER_OWNER = 500;
41+
42+
@@ -669,14 +668,18 @@ public class DexUseManagerLocal {
43+
@NonNull String classLoaderContext, @NonNull String abiName, long lastUsedAtMs) {
44+
DexLoader loader = DexLoader.create(loadingPackageName, isolatedProcess);
45+
// This is to avoid a loading package from using up the SecondaryDexUse entries for another
46+
- // package (up to the MAX_SECONDARY_DEX_FILES_PER_OWNER limit). We don't care about the
47+
- // loading package messing up its own SecondaryDexUse entries.
48+
+ // package (up to the MAX_SECONDARY_DEX_FILES_PER_OWNER limit).
49+
// Note that we are using system_server's permission to check the existence. This is fine
50+
// with the assumption that the file must be world readable to be used by other apps.
51+
// We could use artd's permission to check the existence, and then there wouldn't be any
52+
// permission issue, but that requires bringing up the artd service, which may be too
53+
// expensive.
54+
// TODO(jiakaiz): Check if the assumption is true.
55+
+ // This doesn't apply to secondary dex files that aren't used by other apps, but we
56+
+ // don't care about the loading package messing up its own SecondaryDexUse
57+
+ // entries.
58+
+ // Also note that the check doesn't follow symlinks because GMSCore creates symlinks to
59+
+ // its secondary dex files, while system_server doesn't have the permission to follow them.
60+
if (isLoaderOtherApp(loader, owningPackageName) && !mInjector.pathExists(dexPath)) {
61+
AsLog.w("Not recording non-existent secondary dex file '" + dexPath + "'");
62+
return;
63+
@@ -1400,7 +1403,7 @@ public class DexUseManagerLocal {
64+
}
65+
66+
public boolean pathExists(String path) {
67+
- return new File(path).exists();
68+
+ return Files.exists(Paths.get(path), LinkOption.NOFOLLOW_LINKS);
69+
}
70+
71+
@NonNull
72+
--
73+
2.34.1
74+
Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
From 9bc398ef01ce6b12b076d32cce37786ca37c1b3a Mon Sep 17 00:00:00 2001
2+
From: Jiakai Zhang <jiakaiz@google.com>
3+
Date: Tue, 25 Mar 2025 08:38:55 -0700
4+
Subject: [PATCH] Omit file existence check on notifyDexContainersLoaded.
5+
6+
This is due to sepolicy restrictions on some platforms.
7+
8+
Bug: 401662336
9+
Bug: 391895923
10+
Test: atest ArtServiceTests
11+
Test: app-debug.apk in b/391895923#comment3
12+
Flag: EXEMPT bugfix
13+
(cherry picked from commit d62d66437f3b322f202c314672fbaf810fde7142)
14+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:39334253c58dedcd928ef5431ad3618b11b02edc)
15+
Merged-In: Ib6d878a678ddafd02fb48d92ddfbabdfd6f4f14e
16+
Change-Id: Ib6d878a678ddafd02fb48d92ddfbabdfd6f4f14e
17+
---
18+
.../server/art/DexUseManagerLocal.java | 22 -------------
19+
.../android/server/art/DexUseManagerTest.java | 33 +------------------
20+
2 files changed, 1 insertion(+), 54 deletions(-)
21+
22+
diff --git a/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java b/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
23+
index b7b42caeed..1bdf31e80a 100644
24+
--- a/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
25+
+++ b/libartservice/service/java/com/android/server/art/DexUseManagerLocal.java
26+
@@ -67,7 +67,6 @@ import java.io.OutputStream;
27+
import java.lang.annotation.Retention;
28+
import java.lang.annotation.RetentionPolicy;
29+
import java.nio.file.Files;
30+
-import java.nio.file.LinkOption;
31+
import java.nio.file.StandardCopyOption;
32+
import java.util.ArrayList;
33+
import java.util.Collections;
34+
@@ -667,23 +666,6 @@ public class DexUseManagerLocal {
35+
@NonNull String loadingPackageName, boolean isolatedProcess,
36+
@NonNull String classLoaderContext, @NonNull String abiName, long lastUsedAtMs) {
37+
DexLoader loader = DexLoader.create(loadingPackageName, isolatedProcess);
38+
- // This is to avoid a loading package from using up the SecondaryDexUse entries for another
39+
- // package (up to the MAX_SECONDARY_DEX_FILES_PER_OWNER limit).
40+
- // Note that we are using system_server's permission to check the existence. This is fine
41+
- // with the assumption that the file must be world readable to be used by other apps.
42+
- // We could use artd's permission to check the existence, and then there wouldn't be any
43+
- // permission issue, but that requires bringing up the artd service, which may be too
44+
- // expensive.
45+
- // TODO(jiakaiz): Check if the assumption is true.
46+
- // This doesn't apply to secondary dex files that aren't used by other apps, but we
47+
- // don't care about the loading package messing up its own SecondaryDexUse
48+
- // entries.
49+
- // Also note that the check doesn't follow symlinks because GMSCore creates symlinks to
50+
- // its secondary dex files, while system_server doesn't have the permission to follow them.
51+
- if (isLoaderOtherApp(loader, owningPackageName) && !mInjector.pathExists(dexPath)) {
52+
- AsLog.w("Not recording non-existent secondary dex file '" + dexPath + "'");
53+
- return;
54+
- }
55+
synchronized (mLock) {
56+
PackageDexUse packageDexUse = mDexUse.mPackageDexUseByOwningPackageName.computeIfAbsent(
57+
owningPackageName, k -> new PackageDexUse());
58+
@@ -1402,10 +1384,6 @@ public class DexUseManagerLocal {
59+
return System.currentTimeMillis();
60+
}
61+
62+
- public boolean pathExists(String path) {
63+
- return Files.exists(Paths.get(path), LinkOption.NOFOLLOW_LINKS);
64+
- }
65+
-
66+
@NonNull
67+
public String getFilename() {
68+
return FILENAME;
69+
diff --git a/libartservice/service/javatests/com/android/server/art/DexUseManagerTest.java b/libartservice/service/javatests/com/android/server/art/DexUseManagerTest.java
70+
index ed4041bdf6..aeddc8b8f7 100644
71+
--- a/libartservice/service/javatests/com/android/server/art/DexUseManagerTest.java
72+
+++ b/libartservice/service/javatests/com/android/server/art/DexUseManagerTest.java
73+
@@ -180,7 +180,6 @@ public class DexUseManagerTest {
74+
75+
lenient().when(mInjector.getArtd()).thenReturn(mArtd);
76+
lenient().when(mInjector.getCurrentTimeMillis()).thenReturn(0l);
77+
- lenient().when(mInjector.pathExists(any())).thenReturn(true);
78+
lenient().when(mInjector.getFilename()).thenReturn(mTempFile.getPath());
79+
lenient()
80+
.when(mInjector.createScheduledExecutor())
81+
@@ -909,12 +908,11 @@ public class DexUseManagerTest {
82+
}
83+
84+
@Test
85+
- public void testExistingExternalSecondaryDexPath() throws Exception {
86+
+ public void testSecondaryDexPath() throws Exception {
87+
mMockClock.advanceTime(DexUseManagerLocal.INTERVAL_MS); // Save.
88+
long oldFileSize = mTempFile.length();
89+
90+
String existingDexPath = mCeDir + "/foo.apk";
91+
- when(mInjector.pathExists(existingDexPath)).thenReturn(true);
92+
mDexUseManager.notifyDexContainersLoaded(
93+
mSnapshot, LOADING_PKG_NAME, Map.of(existingDexPath, "PCL[]"));
94+
95+
@@ -922,35 +920,6 @@ public class DexUseManagerTest {
96+
assertThat(mTempFile.length()).isGreaterThan(oldFileSize);
97+
}
98+
99+
- @Test
100+
- public void testNonexistingExternalSecondaryDexPath() throws Exception {
101+
- mMockClock.advanceTime(DexUseManagerLocal.INTERVAL_MS); // Save.
102+
- long oldFileSize = mTempFile.length();
103+
-
104+
- String nonexistingDexPath = mCeDir + "/foo.apk";
105+
- when(mInjector.pathExists(nonexistingDexPath)).thenReturn(false);
106+
- mDexUseManager.notifyDexContainersLoaded(
107+
- mSnapshot, LOADING_PKG_NAME, Map.of(nonexistingDexPath, "PCL[]"));
108+
-
109+
- mMockClock.advanceTime(DexUseManagerLocal.INTERVAL_MS); // Save.
110+
- assertThat(mTempFile.length()).isEqualTo(oldFileSize);
111+
- }
112+
-
113+
- @Test
114+
- public void testInternalSecondaryDexPath() throws Exception {
115+
- mMockClock.advanceTime(DexUseManagerLocal.INTERVAL_MS); // Save.
116+
- long oldFileSize = mTempFile.length();
117+
-
118+
- String nonexistingDexPath = mCeDir + "/foo.apk";
119+
- lenient().when(mInjector.pathExists(nonexistingDexPath)).thenReturn(false);
120+
- mDexUseManager.notifyDexContainersLoaded(
121+
- mSnapshot, OWNING_PKG_NAME, Map.of(nonexistingDexPath, "PCL[]"));
122+
- verify(mArtd, never()).getDexFileVisibility(nonexistingDexPath);
123+
-
124+
- mMockClock.advanceTime(DexUseManagerLocal.INTERVAL_MS); // Save.
125+
- assertThat(mTempFile.length()).isGreaterThan(oldFileSize);
126+
- }
127+
-
128+
@Test
129+
public void testLimitSecondaryDexFiles() throws Exception {
130+
for (int n = 0; n < MAX_SECONDARY_DEX_FILES_PER_OWNER_FOR_TESTING - 1; ++n) {
131+
--
132+
2.34.1
133+

aosp_diff/preliminary/build/release/0001-Update-RELEASE_PLATFORM_SECURITY_PATCH-string.patch

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ index 4075b588..985e7b01 100644
2020
name: "RELEASE_PLATFORM_SECURITY_PATCH"
2121
value: {
2222
- string_value: "2025-03-05"
23-
+ string_value: "2025-05-01"
23+
+ string_value: "2025-06-01"
2424
}
2525
--
2626
2.34.1
Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
From a5c1d4f8d6d59ec0960b2c13b76431bbbbc61b26 Mon Sep 17 00:00:00 2001
2+
From: Lajos Molnar <lajos@google.com>
3+
Date: Wed, 26 Feb 2025 18:16:50 -0800
4+
Subject: [PATCH] mediandk: clean up AMediaCodec_getInput/OutputBuffer
5+
semantics
6+
7+
AMediaCodec_getInputBuffer erroneously considered the
8+
offset, which could result in a smaller input buffer being
9+
returned and client confusion. In practice, input
10+
buffer offset is rarely used.
11+
12+
Similarly, the buffer size returned from
13+
AMediaCodec_getOutputBuffer included padding after the
14+
output buffer leading to potential confusion.
15+
Now the size returned from both AMediaCodec_getOutputBuffer
16+
and AMediaCodec_dequeueOutputBuffer is correct.
17+
18+
Also removed mentions of non-existing NDK methods
19+
AMediaCodec_getOutputBuffers and AMediaCodec_getInputBuffers.
20+
21+
Bug: 301470262
22+
Flag: EXEMPT bugfix
23+
(cherry picked from commit d69fe7b73a0ed14c2b5bc237f1a42314140c9458)
24+
Merged-in: I6bbd9b85023aef56a608362afde0662d3df7284a
25+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:20cca3672f4fbcef3e8dd0cc1a46f585a576ab3c)
26+
Merged-In: I6bbd9b85023aef56a608362afde0662d3df7284a
27+
Change-Id: I6bbd9b85023aef56a608362afde0662d3df7284a
28+
---
29+
media/ndk/NdkMediaCodec.cpp | 21 ++++++++++++++++-----
30+
media/ndk/include/media/NdkMediaCodec.h | 15 +++++++++++++--
31+
2 files changed, 29 insertions(+), 7 deletions(-)
32+
33+
diff --git a/media/ndk/NdkMediaCodec.cpp b/media/ndk/NdkMediaCodec.cpp
34+
index b230df5179..240848096a 100644
35+
--- a/media/ndk/NdkMediaCodec.cpp
36+
+++ b/media/ndk/NdkMediaCodec.cpp
37+
@@ -672,7 +672,13 @@ uint8_t* AMediaCodec_getInputBuffer(AMediaCodec *mData, size_t idx, size_t *out_
38+
if (out_size != NULL) {
39+
*out_size = abuf->capacity();
40+
}
41+
- return abuf->data();
42+
+
43+
+ // When an input buffer is provided to the application, it is essentially
44+
+ // empty. Ignore its offset as we will set it upon queueInputBuffer.
45+
+ // This actually works as expected as we do not provide visibility of
46+
+ // a potential internal offset to the client, so it is equivalent to
47+
+ // setting the offset to 0 prior to returning the buffer to the client.
48+
+ return abuf->base();
49+
}
50+
51+
android::Vector<android::sp<android::MediaCodecBuffer> > abufs;
52+
@@ -689,7 +695,7 @@ uint8_t* AMediaCodec_getInputBuffer(AMediaCodec *mData, size_t idx, size_t *out_
53+
if (out_size != NULL) {
54+
*out_size = abufs[idx]->capacity();
55+
}
56+
- return abufs[idx]->data();
57+
+ return abufs[idx]->base();
58+
}
59+
ALOGE("couldn't get input buffers");
60+
return NULL;
61+
@@ -704,8 +710,12 @@ uint8_t* AMediaCodec_getOutputBuffer(AMediaCodec *mData, size_t idx, size_t *out
62+
return NULL;
63+
}
64+
65+
+ // Note that we do not provide visibility of the internal offset to the
66+
+ // client, but it also does not make sense to provide visibility of the
67+
+ // buffer capacity vs the actual size.
68+
+
69+
if (out_size != NULL) {
70+
- *out_size = abuf->capacity();
71+
+ *out_size = abuf->size();
72+
}
73+
return abuf->data();
74+
}
75+
@@ -718,7 +728,7 @@ uint8_t* AMediaCodec_getOutputBuffer(AMediaCodec *mData, size_t idx, size_t *out
76+
return NULL;
77+
}
78+
if (out_size != NULL) {
79+
- *out_size = abufs[idx]->capacity();
80+
+ *out_size = abufs[idx]->size();
81+
}
82+
return abufs[idx]->data();
83+
}
84+
@@ -748,7 +758,8 @@ ssize_t AMediaCodec_dequeueOutputBuffer(AMediaCodec *mData,
85+
requestActivityNotification(mData);
86+
switch (ret) {
87+
case OK:
88+
- info->offset = offset;
89+
+ // the output buffer address is already offset in AMediaCodec_getOutputBuffer()
90+
+ info->offset = 0;
91+
info->size = size;
92+
info->flags = flags;
93+
info->presentationTimeUs = presentationTimeUs;
94+
diff --git a/media/ndk/include/media/NdkMediaCodec.h b/media/ndk/include/media/NdkMediaCodec.h
95+
index 598beb709d..223d2f890b 100644
96+
--- a/media/ndk/include/media/NdkMediaCodec.h
97+
+++ b/media/ndk/include/media/NdkMediaCodec.h
98+
@@ -251,6 +251,11 @@ uint8_t* AMediaCodec_getInputBuffer(AMediaCodec*, size_t idx, size_t *out_size)
99+
* dequeueOutputBuffer, and not yet queued.
100+
*
101+
* Available since API level 21.
102+
+ * <p>
103+
+ * At or before API level 35, the out_size returned was invalid, and instead the
104+
+ * size returned in the AMediaCodecBufferInfo struct from
105+
+ * AMediaCodec_dequeueOutputBuffer() should be used. After API
106+
+ * level 35, this API returns the correct output buffer size as well.
107+
*/
108+
uint8_t* AMediaCodec_getOutputBuffer(AMediaCodec*, size_t idx, size_t *out_size) __INTRODUCED_IN(21);
109+
110+
@@ -309,9 +314,16 @@ media_status_t AMediaCodec_queueSecureInputBuffer(AMediaCodec*, size_t idx,
111+
#undef _off_t_compat
112+
113+
/**
114+
- * Get the index of the next available buffer of processed data.
115+
+ * Get the index of the next available buffer of processed data along with the
116+
+ * metadata associated with it.
117+
*
118+
* Available since API level 21.
119+
+ * <p>
120+
+ * At or before API level 35, the offset in the AMediaCodecBufferInfo struct
121+
+ * was invalid and should be ignored; however, at the same time
122+
+ * the buffer size could only be obtained from this struct. After API
123+
+ * level 35, the offset returned in the struct is always set to 0, and the
124+
+ * buffer size can also be obtained from the AMediaCodec_getOutputBuffer() call.
125+
*/
126+
ssize_t AMediaCodec_dequeueOutputBuffer(AMediaCodec*, AMediaCodecBufferInfo *info,
127+
int64_t timeoutUs) __INTRODUCED_IN(21);
128+
@@ -468,7 +480,6 @@ void AMediaCodec_releaseName(AMediaCodec*, char* name) __INTRODUCED_IN(28);
129+
/**
130+
* Set an asynchronous callback for actionable AMediaCodec events.
131+
* When asynchronous callback is enabled, it is an error for the client to call
132+
- * AMediaCodec_getInputBuffers(), AMediaCodec_getOutputBuffers(),
133+
* AMediaCodec_dequeueInputBuffer() or AMediaCodec_dequeueOutputBuffer().
134+
*
135+
* AMediaCodec_flush() behaves differently in asynchronous mode.
136+
--
137+
2.49.0.1077.gc0e912fd4c-goog
138+

0 commit comments

Comments
 (0)