Survive a failed injection, and quieten the scope logs - #826
Merged
Conversation
`sendToBridge` leaves the main thread at euid 1000, and the statement after it opened the config database, which sits under a directory only root can enter. It normally works because a binder thread opens and caches the handle during specialization first, but that only happens when the injection succeeded; when it failed the daemon died on the preference read instead of carrying on.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two minor fixes, unrelated to each other.
A process no module has in scope produced three log lines about it, and one called the daemon's ordinary refusal a failure. The duplicate in
ipc_bridge.cppgoes; the two inmodule.cppnow say what happened. The wording stops short of "out of scope" because the zygisk side cannot tell:BridgeService.onTransactalso returns false when the daemon binder has not arrived yet, or when the process is already registered. The daemon logs the reason itself.sendToBridgeleaves the main thread at euid 1000, and the statement after it read the verbose-log preference out of the config database, which sits under a directory only root can enter. That normally works because a binder thread opens and caches the handle during specialization first, but only when the injection succeeded. When it failed nothing had, and the daemon died on the preference read instead of carrying on — the second half of the crash in #744 and #773. Reading it beforesendToBridgeleaves the check where it was and does the open while we still have root.