diff --git a/drivers/android/node.rs b/drivers/android/node.rs index 954ab322d59eee..c9dc6bbef226e5 100644 --- a/drivers/android/node.rs +++ b/drivers/android/node.rs @@ -212,13 +212,14 @@ pub(crate) struct Node { pub(crate) global_id: u64, ptr: usize, cookie: usize, + pub(crate) flags: u32, pub(crate) owner: Ref, inner: LockedBy>, links: Links, } impl Node { - pub(crate) fn new(ptr: usize, cookie: usize, owner: Ref) -> Self { + pub(crate) fn new(ptr: usize, cookie: usize, flags: u32, owner: Ref) -> Self { static NEXT_ID: AtomicU64 = AtomicU64::new(1); let inner = LockedBy::new( &owner.inner, @@ -232,6 +233,7 @@ impl Node { global_id: NEXT_ID.fetch_add(1, Ordering::Relaxed), ptr, cookie, + flags, owner, inner, links: Links::new(), diff --git a/drivers/android/process.rs b/drivers/android/process.rs index e24b4fce543b48..30a057b45f5db1 100644 --- a/drivers/android/process.rs +++ b/drivers/android/process.rs @@ -367,12 +367,18 @@ impl Process { } fn set_as_manager(&self, info: Option, thread: &Thread) -> Result { - let (ptr, cookie) = if let Some(obj) = info { - (unsafe { obj.__bindgen_anon_1.binder }, obj.cookie) + let (ptr, cookie, flags) = if let Some(obj) = info { + ( + // SAFETY: The object type for this ioctl is implicitly `BINDER_TYPE_BINDER`, so it + // is safe to access the `binder` field. + unsafe { obj.__bindgen_anon_1.binder }, + obj.cookie, + obj.flags, + ) } else { - (0, 0) + (0, 0, 0) }; - let node_ref = self.get_node(ptr as _, cookie as _, true, Some(thread))?; + let node_ref = self.get_node(ptr as _, cookie as _, flags as _, true, Some(thread))?; let node = node_ref.node.clone(); self.ctx.set_manager_node(node_ref)?; self.inner.lock().is_manager = true; @@ -387,6 +393,7 @@ impl Process { &self, ptr: usize, cookie: usize, + flags: u32, strong: bool, thread: Option<&Thread>, ) -> Result { @@ -399,7 +406,7 @@ impl Process { } // Allocate the node before reacquiring the lock. - let node = Arc::try_new(Node::new(ptr, cookie, Ref::new_from(self)))?; + let node = Arc::try_new(Node::new(ptr, cookie, flags, Ref::new_from(self)))?; let mut inner = self.inner.lock(); if let Some(node) = inner.get_existing_node_ref(ptr, cookie, strong, thread)? { diff --git a/drivers/android/thread.rs b/drivers/android/thread.rs index ec290da2a0be02..c51d6b49c4bc69 100644 --- a/drivers/android/thread.rs +++ b/drivers/android/thread.rs @@ -389,7 +389,10 @@ impl Thread { // SAFETY: The type is `BINDER_TYPE_{WEAK_}BINDER`, so `binder` is populated. let ptr = unsafe { obj.__bindgen_anon_1.binder } as _; let cookie = obj.cookie as _; - Ok(self.process.get_node(ptr, cookie, strong, Some(self))?) + let flags = obj.flags as _; + Ok(self + .process + .get_node(ptr, cookie, flags, strong, Some(self))?) })?; } bindings::BINDER_TYPE_WEAK_HANDLE | bindings::BINDER_TYPE_HANDLE => {