Replace tbm_key by tbm_fd for buffer protectiontizen_5.5.m2_releasesubmit/tizen_5.5_mobile_hotfix/20201026.185104submit/tizen_5.5/20191031.000004submit/tizen/20190220.092629submit/tizen/20190219.074619accepted/tizen/unified/20190221.084207accepted/tizen/5.5/unified/mobile/hotfix/20201027.090154accepted/tizen/5.5/unified/20191031.022331tizen_5.5_mobile_hotfixaccepted/tizen_5.5_unified_mobile_hotfix

- Any other process can access buffer if it knows its tbm_key,
  but, there is no way to access if it's replaced by tbm_fd.

[Version] 0.3.15
[Profile] Common
[Issue Type] Update
[Dependency module] mmsvc-camera, capi-media-recorder

Change-Id: Iad10f26e000ef35c278561b04f471a8711dcc517
Signed-off-by: Jeongmo Yang <jm80.yang@samsung.com>

3 files changed, 87 insertions, 49 deletions

diff --git a/muse/include/muse_recorder_msg.h b/muse/include/muse_recorder_msg.h
index 08be928..b63cc4f 100644
--- a/muse/include/muse_recorder_msg.h
+++ b/muse/include/muse_recorder_msg.h
@@ -314,6 +314,39 @@ typedef const char* STRING;
 	} while (0)
 
 /**
+ * @brief Returning the event ack message from the server to client side, adding 2 parameters.
+ * @param[in] api The enumeration of the corresponding api.
+ * @param[in] event The enumeration of the event.
+ * @param[in] class The enumeration of the event class.
+ * @param[in] module The module info for the ipc transportation.
+ * @param[in] param1 The 1st parameter to be included in the message.
+ * @param[in] type2 The data type of the parameter.
+ * @param[in] param2 The 2nd parameter to be included in the message.
+ * @param[in] type3 The data type of the parameter.
+ * @param[in] param3 The 3rd parameter to be included in the message.
+ * @param[in] tfd The tbm fds to be delivered through the socket.
+ */
+#define muse_recorder_msg_event3_fd(api, event, class, module, type1, param1, type2, param2, type3, param3, tfd) \
+	do {	\
+		char *__sndMsg__; \
+		int __len__; \
+		type1 __value1__ = (type1)param1; \
+		type2 __value2__ = (type2)param2; \
+		type3 __value3__ = (type3)param3; \
+		__sndMsg__ = muse_core_msg_new(api, \
+			MUSE_TYPE_INT, PARAM_EVENT, event, \
+			MUSE_TYPE_INT, PARAM_EVENT_CLASS, class, \
+			MUSE_TYPE_##type1, #param1, __value1__, \
+			MUSE_TYPE_##type2, #param2, __value2__, \
+			MUSE_TYPE_##type3, #param3, __value3__, \
+			0); \
+		__len__ = muse_core_msg_send_fd(muse_server_module_get_msg_fd(module), (int *)tfd, __sndMsg__); \
+		if (__len__ <= 0) \
+			LOGE("sending message failed [%d]", __len__); \
+		muse_core_msg_free(__sndMsg__); \
+	} while (0)
+
+/**
  * @brief Returning the event ack message from the server to client side, adding 3 parameters.
  * @param[in] api The enumeration of the corresponding api.
  * @param[in] event The enumeration of the event.
@@ -360,8 +393,9 @@ typedef const char* STRING;
  * @param[in] param4 The 4th parameter to be included in the message.
  * @param[in] type5 The data type of the parameter.
  * @param[in] param5 The 5th parameter to be included in the message.
+ * @param[in] tfd The tbm fds.
  */
-#define muse_recorder_msg_event5(api, event, class, module, type1, param1, type2, param2, type3, param3, type4, param4, type5, param5) \
+#define muse_recorder_msg_event5_fd(api, event, class, module, type1, param1, type2, param2, type3, param3, type4, param4, type5, param5, tfd) \
 	do {	\
 		char *__sndMsg__; \
 		int __len__; \
@@ -369,7 +403,7 @@ typedef const char* STRING;
 		type2 __value2__ = (type2)param2; \
 		type3 __value3__ = (type3)param3; \
 		type4 __value4__ = (type4)param4; \
-		type5 __value5__ = (type5)param5; \
+		type5 __value5__ = (type4)param5; \
 		__sndMsg__ = muse_core_msg_new(api, \
 			MUSE_TYPE_INT, PARAM_EVENT, event, \
 			MUSE_TYPE_INT, PARAM_EVENT_CLASS, class, \
@@ -379,7 +413,7 @@ typedef const char* STRING;
 			MUSE_TYPE_##type4, #param4, __value4__, \
 			MUSE_TYPE_##type5, #param5, __value5__, \
 			0); \
-		__len__ = muse_core_msg_send(muse_server_module_get_msg_fd(module), __sndMsg__); \
+		__len__ = muse_core_msg_send_fd(muse_server_module_get_msg_fd(module), (int *)tfd, __sndMsg__); \
 		if (__len__ <= 0) \
 			LOGE("sending message failed [%d]", __len__); \
 		muse_core_msg_free(__sndMsg__); \
diff --git a/muse/src/muse_recorder_dispatcher.c b/muse/src/muse_recorder_dispatcher.c
index c2e0440..8392b0b 100644
--- a/muse/src/muse_recorder_dispatcher.c
+++ b/muse/src/muse_recorder_dispatcher.c
@@ -51,7 +51,7 @@ static GMutex g_recorder_device_state_lock;
  */
 typedef struct {
 	tbm_bo bo;
-	int key;
+	tbm_fd fd;
 } muse_recorder_export_data;
 
 /**
@@ -266,7 +266,8 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
 	muse_module_h module = (muse_module_h)user_data;
 	muse_recorder_handle_s *muse_recorder = NULL;
 	muse_recorder_export_data *export_data = NULL;
-	int tbm_key = 0;
+	int audio_fd = -1;
+	tbm_fd tfd[MUSE_NUM_FD] = {-1, -1, -1, -1};
 	tbm_bo bo = NULL;
 	tbm_bo_handle bo_handle = {.ptr = NULL};
 
@@ -293,36 +294,28 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
 	bo = tbm_bo_alloc(muse_recorder->bufmgr, size, TBM_BO_DEFAULT);
 	if (bo == NULL) {
 		LOGE("bo alloc failed : bufmgr %p, size %d", muse_recorder->bufmgr, size);
-		g_free(export_data);
-		export_data = NULL;
-		return;
+		goto _BUFFER_FAILED;
 	}
 
 	bo_handle = tbm_bo_map(bo, TBM_DEVICE_CPU, TBM_OPTION_READ | TBM_OPTION_WRITE);
 	if (bo_handle.ptr == NULL) {
 		LOGE("bo map Error!");
-		tbm_bo_unref(bo);
-		g_free(export_data);
-		export_data = NULL;
-		return;
+		goto _BUFFER_FAILED;
 	}
 
 	memcpy(bo_handle.ptr, stream, size);
 
 	tbm_bo_unmap(bo);
 
-	tbm_key = tbm_bo_export(bo);
-	if (tbm_key == 0) {
-		LOGE("Create key_info ERROR!!");
-		tbm_bo_unref(bo);
-		bo = NULL;
-		g_free(export_data);
-		export_data = NULL;
-		return;
+	audio_fd = tbm_bo_export_fd(bo);
+	if (audio_fd < 0) {
+		LOGE("export bo ERROR");
+		goto _BUFFER_FAILED;
 	}
 
 	/* set bo info */
-	export_data->key = tbm_key;
+	tfd[0] = audio_fd;
+	export_data->fd = audio_fd;
 	export_data->bo = bo;
 
 	/* add bo info to list */
@@ -331,7 +324,7 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
 	g_mutex_unlock(&muse_recorder->list_lock);
 
 	/* send message */
-	muse_recorder_msg_event5(MUSE_RECORDER_CB_EVENT,
+	muse_recorder_msg_event5_fd(MUSE_RECORDER_CB_EVENT,
 		MUSE_RECORDER_EVENT_TYPE_AUDIO_STREAM,
 		MUSE_RECORDER_EVENT_CLASS_THREAD_SUB,
 		module,
@@ -339,9 +332,15 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
 		INT, format,
 		INT, channel,
 		INT, timestamp,
-		INT, tbm_key);
+		INT, audio_fd,
+		tfd);
 
 	return;
+
+_BUFFER_FAILED:
+	tbm_bo_unref(bo);
+	g_free(export_data);
+	return;
 }
 
 void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long offset, void *user_data)
@@ -349,7 +348,8 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
 	muse_module_h module = (muse_module_h)user_data;
 	muse_recorder_handle_s *muse_recorder = NULL;
 	muse_recorder_export_data *export_data = NULL;
-	int tbm_key = 0;
+	int muxed_fd = -1;
+	tbm_fd tfd[MUSE_NUM_FD] = {-1, -1, -1, -1};
 	tbm_bo bo = NULL;
 	tbm_bo_handle bo_handle = {.ptr = NULL};
 
@@ -389,14 +389,15 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
 
 	tbm_bo_unmap(bo);
 
-	tbm_key = tbm_bo_export(bo);
-	if (tbm_key == 0) {
-		LOGE("Create key_info ERROR!!");
+	muxed_fd = tbm_bo_export_fd(bo);
+	if (muxed_fd < 0) {
+		LOGE("export bo ERROR");
 		goto _MUXED_STREAM_CB_ERROR;
 	}
 
 	/* set bo info */
-	export_data->key = tbm_key;
+	tfd[0] = muxed_fd;
+	export_data->fd = muxed_fd;
 	export_data->bo = bo;
 
 	/* add bo info to list */
@@ -405,13 +406,14 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
 	g_mutex_unlock(&muse_recorder->list_lock);
 
 	/* send message */
-	muse_recorder_msg_event3(MUSE_RECORDER_CB_EVENT,
+	muse_recorder_msg_event3_fd(MUSE_RECORDER_CB_EVENT,
 		MUSE_RECORDER_EVENT_TYPE_MUXED_STREAM,
 		MUSE_RECORDER_EVENT_CLASS_THREAD_SUB,
 		module,
 		INT, size,
-		INT, tbm_key,
-		INT64, offset);
+		INT64, offset,
+		INT, muxed_fd,
+		tfd);
 
 	return;
 
@@ -502,14 +504,14 @@ bool _recorder_disp_foreach_supported_video_encoder_cb(recorder_video_codec_e co
 	return true;
 }
 
-static int _recorder_remove_export_data(muse_module_h module, int key, int remove_all)
+static int _recorder_remove_export_data(muse_module_h module, tbm_fd fd, int remove_all)
 {
 	muse_recorder_handle_s *muse_recorder = NULL;
 	GList *tmp_list = NULL;
 	muse_recorder_export_data *export_data = NULL;
 
-	if (module == NULL || (key <= 0 && remove_all == FALSE)) {
-		LOGE("invalid parameter %p, %d", module, key);
+	if (module == NULL || (fd < 0 && remove_all == FALSE)) {
+		LOGE("invalid parameter %p, %d", module, fd);
 		return FALSE;
 	}
 
@@ -526,16 +528,19 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
 	while (tmp_list) {
 		export_data = (muse_recorder_export_data *)tmp_list->data;
 		if (export_data) {
-			if (export_data->key == key || remove_all) {
-				/*LOGD("key %d matched, remove it (remove_all %d)", key, remove_all);*/
+			if (export_data->fd == fd || remove_all) {
+				/*LOGD("fd %d matched, remove it (remove_all %d)", fd, remove_all);*/
 
 				if (export_data->bo) {
 					tbm_bo_unref(export_data->bo);
 					export_data->bo = NULL;
 				} else {
-					LOGW("bo for key %d is NULL", key);
+					LOGW("bo for fd %d is NULL", fd);
 				}
-				export_data->key = 0;
+
+				/* close exported fd */
+				close(export_data->fd);
+				export_data->fd = -1;
 
 				muse_recorder->data_list = g_list_remove(muse_recorder->data_list, export_data);
 
@@ -543,7 +548,7 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
 				export_data = NULL;
 
 				if (remove_all == FALSE) {
-					/*LOGD("key %d, remove done");*/
+					/*LOGD("fd %d, remove done", fd);*/
 					g_mutex_unlock(&muse_recorder->list_lock);
 					return TRUE;
 				} else {
@@ -562,7 +567,7 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
 	if (remove_all)
 		LOGD("remove all done");
 	else
-		LOGE("should not be reached here - key %d", key);
+		LOGE("should not be reached here - fd %d", fd);
 
 	return FALSE;
 }
@@ -2227,7 +2232,7 @@ int recorder_dispatcher_attr_set_root_directory(muse_module_h module)
 
 int recorder_dispatcher_return_buffer(muse_module_h module)
 {
-	int tbm_key = 0;
+	int ret_fd = -1;
 	muse_recorder_handle_s *muse_recorder = NULL;
 
 	muse_recorder = (muse_recorder_handle_s *)muse_server_ipc_get_handle(module);
@@ -2236,12 +2241,12 @@ int recorder_dispatcher_return_buffer(muse_module_h module)
 		return MUSE_RECORDER_ERROR_NONE;
 	}
 
-	muse_recorder_msg_get(tbm_key, muse_server_module_get_msg(module));
+	muse_recorder_msg_get(ret_fd, muse_server_module_get_msg(module));
 
-	/*LOGD("handle : %p, key : %d", muse_recorder, tbm_key);*/
+	/*LOGD("handle : %p, ret_fd : %d", muse_recorder, ret_fd);*/
 
-	if (!_recorder_remove_export_data(module, tbm_key, FALSE))
-		LOGE("remove export data failed : key %d", tbm_key);
+	if (!_recorder_remove_export_data(module, (tbm_fd)ret_fd, FALSE))
+		LOGE("remove export data failed : fd %d", ret_fd);
 
 	return MUSE_RECORDER_ERROR_NONE;
 }
@@ -2489,7 +2494,7 @@ static int recorder_cmd_dispatcher_shutdown(muse_module_h module)
 
 	legacy_recorder_get_state(muse_recorder->recorder_handle, &state);
 
-	LOGW("current state : %d", state);
+	LOGW("shutdown handle %p [state:%d]", muse_recorder->recorder_handle, state);
 
 	switch (state) {
 	case RECORDER_STATE_PAUSED:
@@ -2515,8 +2520,7 @@ static int recorder_cmd_dispatcher_shutdown(muse_module_h module)
 			free(muse_recorder);
 			muse_recorder = NULL;
 		} else {
-			LOGE("shutdown failed for handle %p %p",
-				muse_recorder, muse_recorder->recorder_handle);
+			LOGE("shutdown failed");
 		}
 		break;
 	default:
diff --git a/packaging/mmsvc-recorder.spec b/packaging/mmsvc-recorder.spec
index 6c38fb7..20d3df1 100644
--- a/packaging/mmsvc-recorder.spec
+++ b/packaging/mmsvc-recorder.spec
@@ -1,6 +1,6 @@
 Name:       mmsvc-recorder
 Summary:    A Recorder module for muse server
-Version:    0.3.14
+Version:    0.3.15
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0