Skip to content

Commit dedbb13

Browse files
kancharxsysopenci
kancharx
authored and
sysopenci
committed
[STS] Fixing STS failures
Including fixes for CVE_2025_22429 and CVE_2025_26436 Tracked-On: OAM-134642 Signed-off-by: kancharx <kancharlax.suresh@intel.com>
1 parent 6a247ea commit dedbb13

File tree

3 files changed

+346
-0
lines changed

3 files changed

+346
-0
lines changed

‎aosp_diff/caas/frameworks/base/0029-BaseBundle-fix-unparcel-error-logic.patch‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
From 019112a98cf17e98911f4d2fed080b237bdedce7 Mon Sep 17 00:00:00 2001
2+
From: kancharx <kancharlax.suresh@intel.com>
3+
Date: Wed, 3 Dec 2025 12:29:49 +0000
4+
Subject: [PATCH] [CVE_2025_22429]BaseBundle: fix unparcel error logic
5+
6+
Tracked-On: OAM-134642
7+
Signed-off-by: kancharx <kancharlax.suresh@intel.com>
8+
9+
This code considered a success case to be an unsuccessful
10+
case.
11+
12+
Bug: 373357090
13+
Test: repro in bug no longer works
14+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:6063eb2b1eb076fb3d73e1403ca81fcb6e0d04ee)
15+
Merged-In: Id423936872cbb0e0265ccf2855092357cb175d47
16+
Change-Id: Id423936872cbb0e0265ccf2855092357cb175d47
17+
---
18+
core/java/android/os/BaseBundle.java | 10 +++++-----
19+
core/java/android/os/Parcel.java | 12 +++++-------
20+
2 files changed, 10 insertions(+), 12 deletions(-)
21+
22+
diff --git a/core/java/android/os/BaseBundle.java b/core/java/android/os/BaseBundle.java
23+
index 50121278f0e6..e2315d52e6b4 100644
24+
--- a/core/java/android/os/BaseBundle.java
25+
+++ b/core/java/android/os/BaseBundle.java
26+
@@ -475,10 +475,10 @@ public class BaseBundle {
27+
map.erase();
28+
map.ensureCapacity(count);
29+
}
30+
- int numLazyValues = 0;
31+
+ int[] numLazyValues = new int[]{0};
32+
try {
33+
- numLazyValues = parcelledData.readArrayMap(map, count, !parcelledByNative,
34+
- /* lazy */ ownsParcel, mClassLoader);
35+
+ parcelledData.readArrayMap(map, count, !parcelledByNative,
36+
+ /* lazy */ ownsParcel, mClassLoader, numLazyValues);
37+
} catch (BadParcelableException e) {
38+
if (sShouldDefuse) {
39+
Log.w(TAG, "Failed to parse Bundle, but defusing quietly", e);
40+
@@ -489,14 +489,14 @@ public class BaseBundle {
41+
} finally {
42+
mWeakParcelledData = null;
43+
if (ownsParcel) {
44+
- if (numLazyValues == 0) {
45+
+ if (numLazyValues[0] == 0) {
46+
recycleParcel(parcelledData);
47+
} else {
48+
mWeakParcelledData = new WeakReference<>(parcelledData);
49+
}
50+
}
51+
52+
- mLazyValues = numLazyValues;
53+
+ mLazyValues = numLazyValues[0];
54+
mParcelledByNative = false;
55+
mMap = map;
56+
// Set field last as it is volatile
57+
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
58+
index cf473ec9c3ea..26f768cc49f7 100644
59+
--- a/core/java/android/os/Parcel.java
60+
+++ b/core/java/android/os/Parcel.java
61+
@@ -5538,7 +5538,7 @@ public final class Parcel {
62+
63+
private void readArrayMapInternal(@NonNull ArrayMap<? super String, Object> outVal,
64+
int size, @Nullable ClassLoader loader) {
65+
- readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader);
66+
+ readArrayMap(outVal, size, /* sorted */ true, /* lazy */ false, loader, null);
67+
}
68+
69+
/**
70+
@@ -5548,17 +5548,16 @@ public final class Parcel {
71+
* @param lazy Whether to populate the map with lazy {@link Function} objects for
72+
* length-prefixed values. See {@link Parcel#readLazyValue(ClassLoader)} for more
73+
* details.
74+
- * @return a count of the lazy values in the map
75+
+ * @param lazyValueCount number of lazy values added here
76+
* @hide
77+
*/
78+
- int readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
79+
- boolean lazy, @Nullable ClassLoader loader) {
80+
- int lazyValues = 0;
81+
+ void readArrayMap(ArrayMap<? super String, Object> map, int size, boolean sorted,
82+
+ boolean lazy, @Nullable ClassLoader loader, int[] lazyValueCount) {
83+
while (size > 0) {
84+
String key = readString();
85+
Object value = (lazy) ? readLazyValue(loader) : readValue(loader);
86+
if (value instanceof LazyValue) {
87+
- lazyValues++;
88+
+ lazyValueCount[0]++;
89+
}
90+
if (sorted) {
91+
map.append(key, value);
92+
@@ -5570,7 +5569,6 @@ public final class Parcel {
93+
if (sorted) {
94+
map.validate();
95+
}
96+
- return lazyValues;
97+
}
98+
99+
/**
100+
--
101+
2.34.1
102+

‎aosp_diff/caas/frameworks/base/0030-Add-equals-method.patch‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
From 13cf3cecd295087912ffd380c7c97a3e41495133 Mon Sep 17 00:00:00 2001
2+
From: kancharx <kancharlax.suresh@intel.com>
3+
Date: Wed, 3 Dec 2025 13:30:39 +0000
4+
Subject: [PATCH] [CVE_2025_26436]Add equals method
5+
6+
Tracked-On: OAM-134642
7+
Signed-off-by: kancharx <kancharlax.suresh@intel.com>
8+
9+
This adds an equals method which will for now only be used in tests.
10+
11+
Test: atest BackgroundStartPrivilegesTest
12+
Flag: EXEMPT test only
13+
Bug: 322159724
14+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8aef21b72dca756458d25a42599779997d199f09)
15+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f6f2d41ffcd246afb758042b8fdbca9b5775c579)
16+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:815cca137f84295c6037fd04e9de8011392a0ca6)
17+
Merged-In: Ia726fa205b73a693fee775e4a08950ecd4b5f882
18+
Change-Id: Ia726fa205b73a693fee775e4a08950ecd4b5f882
19+
---
20+
.../app/BackgroundStartPrivileges.java | 21 ++++++++++++++++++-
21+
.../app/BackgroundStartPrivilegesTest.java | 11 ++++++++++
22+
2 files changed, 31 insertions(+), 1 deletion(-)
23+
24+
diff --git a/core/java/android/app/BackgroundStartPrivileges.java b/core/java/android/app/BackgroundStartPrivileges.java
25+
index 20278eaee3b2..adea0a8a0702 100644
26+
--- a/core/java/android/app/BackgroundStartPrivileges.java
27+
+++ b/core/java/android/app/BackgroundStartPrivileges.java
28+
@@ -23,12 +23,13 @@ import android.os.IBinder;
29+
import com.android.internal.util.Preconditions;
30+
31+
import java.util.List;
32+
+import java.util.Objects;
33+
34+
/**
35+
* Privileges granted to a Process that allows it to execute starts from the background.
36+
* @hide
37+
*/
38+
-public class BackgroundStartPrivileges {
39+
+public final class BackgroundStartPrivileges {
40+
/** No privileges. */
41+
public static final BackgroundStartPrivileges NONE = new BackgroundStartPrivileges(
42+
false, false, null);
43+
@@ -190,4 +191,22 @@ public class BackgroundStartPrivileges {
44+
+ ", originatingToken=" + mOriginatingToken
45+
+ ']';
46+
}
47+
+
48+
+ @Override
49+
+ public boolean equals(Object o) {
50+
+ if (this == o) return true;
51+
+ if (o == null || getClass() != o.getClass()) return false;
52+
+ BackgroundStartPrivileges that = (BackgroundStartPrivileges) o;
53+
+ return mAllowsBackgroundActivityStarts == that.mAllowsBackgroundActivityStarts
54+
+ && mAllowsBackgroundForegroundServiceStarts
55+
+ == that.mAllowsBackgroundForegroundServiceStarts
56+
+ && Objects.equals(mOriginatingToken, that.mOriginatingToken);
57+
+ }
58+
+
59+
+ @Override
60+
+ public int hashCode() {
61+
+ return Objects.hash(mAllowsBackgroundActivityStarts,
62+
+ mAllowsBackgroundForegroundServiceStarts,
63+
+ mOriginatingToken);
64+
+ }
65+
}
66+
diff --git a/core/tests/coretests/src/android/app/BackgroundStartPrivilegesTest.java b/core/tests/coretests/src/android/app/BackgroundStartPrivilegesTest.java
67+
index cf6266c756ce..931d64640ea2 100644
68+
--- a/core/tests/coretests/src/android/app/BackgroundStartPrivilegesTest.java
69+
+++ b/core/tests/coretests/src/android/app/BackgroundStartPrivilegesTest.java
70+
@@ -119,4 +119,15 @@ public class BackgroundStartPrivilegesTest {
71+
Arrays.asList(BSP_ALLOW_A, BSP_ALLOW_A, BSP_ALLOW_A, BSP_ALLOW_A)))
72+
.isEqualTo(BSP_ALLOW_A);
73+
}
74+
+
75+
+ @Test
76+
+ public void backgroundStartPrivilege_equals_works() {
77+
+ assertThat(NONE).isEqualTo(NONE);
78+
+ assertThat(ALLOW_BAL).isEqualTo(ALLOW_BAL);
79+
+ assertThat(ALLOW_FGS).isEqualTo(ALLOW_FGS);
80+
+ assertThat(BSP_ALLOW_A).isEqualTo(BSP_ALLOW_A);
81+
+ assertThat(NONE).isNotEqualTo(ALLOW_BAL);
82+
+ assertThat(ALLOW_FGS).isNotEqualTo(ALLOW_BAL);
83+
+ assertThat(BSP_ALLOW_A).isNotEqualTo(BSP_ALLOW_B);
84+
+ }
85+
}
86+
--
87+
2.34.1
88+

‎aosp_diff/caas/frameworks/base/0031-RESTRICT-AUTOMERGE-Clear-the-BAL-allowlist-durat.patch‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
From a1e39f150a5ab95a7c251bf7c88ed3aa5e2443db Mon Sep 17 00:00:00 2001
2+
From: kancharx <kancharlax.suresh@intel.com>
3+
Date: Wed, 3 Dec 2025 13:36:13 +0000
4+
Subject: [PATCH] [CVE_2025_26436]RESTRICT AUTOMERGE Clear the BAL allowlist
5+
duration
6+
7+
Tracked-On: OAM-134642
8+
Signed-off-by: kancharx <kancharlax.suresh@intel.com>
9+
10+
Clearing BAL privileges of a PendingIntent only cleared the tokens,
11+
but kept the duration based entries. `clearAllowBgActivityStarts` is exclusively used by SystemUI (in NotificationManagerService) and fixing this is part of fixing a security vulnerability (therefore and because this is a low risk change it is not flag guarded).
12+
13+
BYPASS_INCLUSIVE_LANGUAGE_REASON=Using an existing API
14+
15+
Bug: 322159724
16+
Flag: EXEMPT bugfix
17+
Test: atest PendingIntentControllerTest
18+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5782703d0f7c913477f1dd59b11e6e6e879199d9)
19+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:014d574afb413850c300f07af43148bf8ff684b6)
20+
Merged-In: I88e4df8fe4989fbc26aaa0e672626f3a1042678e
21+
Change-Id: I88e4df8fe4989fbc26aaa0e672626f3a1042678e
22+
---
23+
.../server/am/PendingIntentRecord.java | 14 ++++++-
24+
.../am/PendingIntentControllerTest.java | 41 +++++++++++++++++++
25+
2 files changed, 54 insertions(+), 1 deletion(-)
26+
27+
diff --git a/services/core/java/com/android/server/am/PendingIntentRecord.java b/services/core/java/com/android/server/am/PendingIntentRecord.java
28+
index 3817ba1a28b9..91501701e815 100644
29+
--- a/services/core/java/com/android/server/am/PendingIntentRecord.java
30+
+++ b/services/core/java/com/android/server/am/PendingIntentRecord.java
31+
@@ -18,6 +18,8 @@ package com.android.server.am;
32+
33+
import static android.app.ActivityManager.PROCESS_STATE_TOP;
34+
import static android.app.ActivityManager.START_SUCCESS;
35+
+import static android.os.PowerWhitelistManager.TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED;
36+
+import static android.os.PowerWhitelistManager.TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_NOT_ALLOWED;
37+
import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_ALLOWED;
38+
import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_ALLOW_ALWAYS;
39+
import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_COMPAT;
40+
@@ -304,6 +306,9 @@ public final class PendingIntentRecord extends IIntentSender.Stub {
41+
}
42+
this.stringName = null;
43+
}
44+
+ @VisibleForTesting TempAllowListDuration getAllowlistDurationLocked(IBinder allowlistToken) {
45+
+ return mAllowlistDuration.get(allowlistToken);
46+
+ }
47+
48+
void setAllowBgActivityStarts(IBinder token, int flags) {
49+
if (token == null) return;
50+
@@ -323,6 +328,13 @@ public final class PendingIntentRecord extends IIntentSender.Stub {
51+
mAllowBgActivityStartsForActivitySender.remove(token);
52+
mAllowBgActivityStartsForBroadcastSender.remove(token);
53+
mAllowBgActivityStartsForServiceSender.remove(token);
54+
+ if (mAllowlistDuration != null) {
55+
+ TempAllowListDuration duration = mAllowlistDuration.get(token);
56+
+ if (duration != null
57+
+ && duration.type == TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED) {
58+
+ duration.type = TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_NOT_ALLOWED;
59+
+ }
60+
+ }
61+
}
62+
63+
public void registerCancelListenerLocked(IResultReceiver receiver) {
64+
@@ -703,7 +715,7 @@ public final class PendingIntentRecord extends IIntentSender.Stub {
65+
return res;
66+
}
67+
68+
- private BackgroundStartPrivileges getBackgroundStartPrivilegesForActivitySender(
69+
+ @VisibleForTesting BackgroundStartPrivileges getBackgroundStartPrivilegesForActivitySender(
70+
IBinder allowlistToken) {
71+
return mAllowBgActivityStartsForActivitySender.contains(allowlistToken)
72+
? BackgroundStartPrivileges.allowBackgroundActivityStarts(allowlistToken)
73+
diff --git a/services/tests/mockingservicestests/src/com/android/server/am/PendingIntentControllerTest.java b/services/tests/mockingservicestests/src/com/android/server/am/PendingIntentControllerTest.java
74+
index 89b48bad2358..d3727ed5e988 100644
75+
--- a/services/tests/mockingservicestests/src/com/android/server/am/PendingIntentControllerTest.java
76+
+++ b/services/tests/mockingservicestests/src/com/android/server/am/PendingIntentControllerTest.java
77+
@@ -16,11 +16,16 @@
78+
79+
package com.android.server.am;
80+
81+
+import static android.os.PowerWhitelistManager.REASON_NOTIFICATION_SERVICE;
82+
+import static android.os.PowerWhitelistManager.TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED;
83+
+import static android.os.PowerWhitelistManager.TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_NOT_ALLOWED;
84+
+
85+
import static android.os.Process.INVALID_UID;
86+
87+
import static com.android.dx.mockito.inline.extended.ExtendedMockito.doReturn;
88+
import static com.android.dx.mockito.inline.extended.ExtendedMockito.mockitoSession;
89+
import static com.android.dx.mockito.inline.extended.ExtendedMockito.verify;
90+
+import static com.android.server.am.PendingIntentRecord.FLAG_ACTIVITY_SENDER;
91+
import static com.android.server.am.PendingIntentRecord.CANCEL_REASON_NULL;
92+
import static com.android.server.am.PendingIntentRecord.CANCEL_REASON_ONE_SHOT_SENT;
93+
import static com.android.server.am.PendingIntentRecord.CANCEL_REASON_OWNER_CANCELED;
94+
@@ -30,6 +35,7 @@ import static com.android.server.am.PendingIntentRecord.CANCEL_REASON_USER_STOPP
95+
import static com.android.server.am.PendingIntentRecord.cancelReasonToString;
96+
97+
import static org.junit.Assert.assertEquals;
98+
+import static org.junit.Assert.assertNotNull;
99+
import static org.mockito.ArgumentMatchers.anyInt;
100+
import static org.mockito.ArgumentMatchers.anyLong;
101+
import static org.mockito.ArgumentMatchers.eq;
102+
@@ -39,9 +45,11 @@ import static org.mockito.Mockito.when;
103+
import android.app.ActivityManager;
104+
import android.app.ActivityManagerInternal;
105+
import android.app.AppGlobals;
106+
+import android.app.BackgroundStartPrivileges;
107+
import android.app.PendingIntent;
108+
import android.content.Intent;
109+
import android.content.pm.IPackageManager;
110+
+import android.os.Binder;
111+
import android.os.Looper;
112+
import android.os.UserHandle;
113+
114+
@@ -185,6 +193,39 @@ public class PendingIntentControllerTest {
115+
assertEquals(errMsg, expectedReason, actualReason);
116+
}
117+
118+
+ @Test
119+
+ public void testClearAllowBgActivityStartsClearsToken() {
120+
+ final PendingIntentRecord pir = createPendingIntentRecord(0);
121+
+ Binder token = new Binder();
122+
+ pir.setAllowBgActivityStarts(token, FLAG_ACTIVITY_SENDER);
123+
+ assertEquals(BackgroundStartPrivileges.allowBackgroundActivityStarts(token),
124+
+ pir.getBackgroundStartPrivilegesForActivitySender(token));
125+
+ pir.clearAllowBgActivityStarts(token);
126+
+ assertEquals(BackgroundStartPrivileges.NONE,
127+
+ pir.getBackgroundStartPrivilegesForActivitySender(token));
128+
+ }
129+
+
130+
+ @Test
131+
+ public void testClearAllowBgActivityStartsClearsDuration() {
132+
+ final PendingIntentRecord pir = createPendingIntentRecord(0);
133+
+ Binder token = new Binder();
134+
+ pir.setAllowlistDurationLocked(token, 1000,
135+
+ TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED, REASON_NOTIFICATION_SERVICE,
136+
+ "NotificationManagerService");
137+
+ PendingIntentRecord.TempAllowListDuration allowlistDurationLocked =
138+
+ pir.getAllowlistDurationLocked(token);
139+
+ assertEquals(1000, allowlistDurationLocked.duration);
140+
+ assertEquals(TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED,
141+
+ allowlistDurationLocked.type);
142+
+ pir.clearAllowBgActivityStarts(token);
143+
+ PendingIntentRecord.TempAllowListDuration allowlistDurationLockedAfterClear =
144+
+ pir.getAllowlistDurationLocked(token);
145+
+ assertNotNull(allowlistDurationLockedAfterClear);
146+
+ assertEquals(1000, allowlistDurationLockedAfterClear.duration);
147+
+ assertEquals(TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_NOT_ALLOWED,
148+
+ allowlistDurationLocked.type);
149+
+ }
150+
+
151+
@After
152+
public void tearDown() {
153+
if (mMockingSession != null) {
154+
--
155+
2.34.1
156+

0 commit comments

Comments
 (0)