Skip to content

Commit 73571c7

Browse files
authored
Fix daemon crash from the Android 17 IServiceConnection change (#784)
Android 17 (API 37) reshaped the IServiceConnection callback and dropped the old overload instead of keeping both: void connected(in ComponentName name, IBinder service, in @nullable IBinderSession session, boolean dead); ManagerGuard overrode only the three-argument form, so as soon as system_server dispatched the new transaction the Stub landed on an abstract method and the daemon died with AbstractMethodError, taking the manager session down with it. Only the Xiaomi XSpace workaround binds this connection, which is why the crash was reported on HyperOS first; the interface change itself ships in stock Android 17 and is not vendor specific. Declare both overloads in the IServiceConnection stub and override both in ManagerGuard, so every supported release finds the method system_server dispatches. IBinderSession is stubbed as an empty interface, since the type is only referenced by the descriptor of the new overload.
1 parent 7fd88c9 commit 73571c7

3 files changed

Lines changed: 23 additions & 0 deletions

File tree

daemon/src/main/kotlin/org/matrix/vector/daemon/ipc/ManagerService.kt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,18 @@ object ManagerService : ILSPManagerService.Stub() {
5353

5454
class ManagerGuard(private val binder: IBinder, val pid: Int, val uid: Int) :
5555
IBinder.DeathRecipient {
56+
// system_server dispatches the 3-argument callback up to Android 16 and the
57+
// 4-argument one from Android 17 on.
5658
private val connection =
5759
object : android.app.IServiceConnection.Stub() {
5860
override fun connected(name: ComponentName?, service: IBinder?, dead: Boolean) {}
61+
62+
override fun connected(
63+
name: ComponentName?,
64+
service: IBinder?,
65+
session: android.app.IBinderSession?,
66+
dead: Boolean
67+
) {}
5968
}
6069

6170
init {
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
package android.app;
2+
3+
import android.os.IInterface;
4+
5+
/**
6+
* Stub of {@code android.app.IBinderSession}, added in Android 17 (API 37),
7+
* where it appears as a parameter of {@link IServiceConnection#connected}.
8+
*/
9+
public interface IBinderSession extends IInterface {}

hiddenapi/stubs/src/main/java/android/app/IServiceConnection.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@
66
import android.os.IInterface;
77

88
public interface IServiceConnection extends IInterface {
9+
10+
/** Declared by the framework up to Android 16. */
911
void connected(ComponentName name, IBinder service, boolean dead);
1012

13+
/** Declared by the framework from Android 17 (API 37) on. */
14+
void connected(ComponentName name, IBinder service, IBinderSession session, boolean dead);
15+
1116
abstract class Stub extends Binder implements IServiceConnection {
1217

1318
public static IServiceConnection asInterface(IBinder obj) {

0 commit comments

Comments
 (0)