[Fix] (Remote): offer inproc no shared images and refuse them on its server

MobileGL/MG_Remote/Client/ClientSession.cpp

@@ -3012,8 +3012,7 @@ namespace MobileGL::MG_Remote::Client {
     Bool ClientSession::AdoptT0() {
         if (!m_adoptT0Asked) return false;
         if (m_adoptT0Decision >= 0) return m_adoptT0Decision == 1;
-        const Bool peerIsThisProcess = m_transport != nullptr &&
-            Transport::AdoptT0::PeerIsThisProcess(m_transport->Role() == Transport::TransportRole::InProcess);
+        const Bool peerIsThisProcess = Transport::PeerIsThisProcess(m_transport);
         if (Caps().HasCap(MG_Pipe::kCapAdoptT0) && peerIsThisProcess &&
             !Caps().HasCap(MG_Pipe::kCapAdoptInProcess)) {
             // A server in this process offered the AHardwareBuffer arm. The stores are this

MobileGL/MG_Remote/Server/PipeApplier.cpp

@@ -390,6 +390,9 @@ namespace MobileGL::MG_Remote::Server {
         ServerSession* session = ServerSession::Active();
         if (session == nullptr) return false;
         SI::SessionHolder& holder = session->SharedImageHolder();
+        // Shared images carry memory between processes. A client in this process has none to
+        // carry, so it gets none - no platform buffer is ever allocated or imported for it.
+        const Bool peerIsThisProcess = Transport::PeerIsThisProcess(session->ControlTransport());
         const auto fill = [&reply](const SI::Image& image) {
             reply.ImageId = image.Id;
             reply.Modifier = image.Modifier;
@@ -403,6 +406,10 @@ namespace MobileGL::MG_Remote::Server {
         };
         switch (op.Op) {
         case MG_Pipe::kMGPSharedImageAllocate: {
+            if (peerIsThisProcess) {
+                MGLOG_W_ONCE("MG_Remote server: a shared-image allocation was refused: the client is this process");
+                return false;
+            }
             std::string why;
             SI::ImageRef image = SI::Allocate(op.Width, op.Height, op.Format, why);
             if (image == nullptr) {
@@ -436,6 +443,13 @@ namespace MobileGL::MG_Remote::Server {
                         static_cast<unsigned long long>(seq), why.c_str());
                 return false;
             }
+            if (peerIsThisProcess) {
+#if !defined(_WIN32)
+                ::close(fd);
+#endif
+                MGLOG_W_ONCE("MG_Remote server: a dma-buf import was refused: the client is this process");
+                return false;
+            }
             SI::ImageRef image = SI::Identify(fd, why);
             // YUV: the planes and colour hints ride in Damage (MGPImportPlaneWord). A buffer this
             // server did not allocate is taken too, through the labelled CPU-copy fallback

MobileGL/MG_Remote/Server/ServerSession.cpp

@@ -1160,8 +1160,7 @@ namespace MobileGL::MG_Remote::Server {
         // stores' own mappings, donated as monolith donates them, and no AHardwareBuffer, import
         // or POST is involved. A backend that cannot donate leaves the session on T2 - an
         // in-process session never takes the AHardwareBuffer arm below.
-        const Bool inProcess = m_transport != nullptr &&
-            Transport::AdoptT0::PeerIsThisProcess(m_transport->Role() == Transport::TransportRole::InProcess);
+        const Bool inProcess = Transport::PeerIsThisProcess(m_transport);
         if (inProcess) {
             const MG_Pipe::MGPipeResourceOps* ops = MG_Pipe::MGPipeGetResourceOps();
             if (MG_Config::Ipc.AllowAdoptT0 == 0) {

MobileGL/MG_Remote/Transport/AdoptT0.cpp

@@ -184,18 +184,6 @@ namespace MobileGL::MG_Remote::Transport::AdoptT0 {
         return test != nullptr ? test->HasAhb() : RealHasAhb();
     }
 
-    namespace {
-        std::atomic<bool> g_peerInAnotherProcessForTest{false};
-    } // namespace
-
-    bool PeerIsThisProcess(bool inProcessTransport) {
-        return inProcessTransport && !g_peerInAnotherProcessForTest.load(std::memory_order_acquire);
-    }
-
-    void SetPeerInAnotherProcessForTest(bool asIfCrossProcess) {
-        g_peerInAnotherProcessForTest.store(asIfCrossProcess, std::memory_order_release);
-    }
-
     bool AllocateHeld(std::uint64_t size, const void* seed, HeldStore& out, std::string& why) {
         const PlatformForTest* test = g_testPlatform.load(std::memory_order_acquire);
         return test != nullptr ? test->AllocateHeld(size, seed, out, why) : RealAllocateHeld(size, seed, out, why);

MobileGL/MG_Remote/Transport/AdoptT0.h

@@ -56,13 +56,9 @@ namespace MobileGL::MG_Remote::Transport::AdoptT0 {
     // True where AHardwareBuffer exists (Android). Everywhere else T0 is never granted.
     bool PlatformHasAhb();
 
-    // True when a session's peer is this very process (an in-process transport). Such a session
-    // never takes this header's arm: its stores are this process's memory already, so T0 there is
-    // the backend handing over its own store (kCapAdoptInProcess) or nothing (T2).
-    bool PeerIsThisProcess(bool inProcessTransport);
-    // Test seam: the protocol tests run over an in-process transport and stand for a peer in
-    // another process while this is set.
-    void SetPeerInAnotherProcessForTest(bool asIfCrossProcess);
+    // A session whose peer is this very process (Transport::PeerIsThisProcess) never takes this
+    // header's arm: its stores are this process's memory already, so T0 there is the backend
+    // handing over its own store (kCapAdoptInProcess) or nothing (T2).
 
     // ---- client half ----------------------------------------------------------------------
 

MobileGL/MG_Remote/Transport/ITransport.h

@@ -127,4 +127,12 @@ namespace MobileGL::MG_Remote::Transport {
         ITransport() = default;
     };
 
+    // True when the session on `transport` has this very process as its peer (an in-process
+    // transport). Its memory is the peer's already, so what exists only to carry memory between
+    // processes - T0's handle arm, shared images - is never offered on it.
+    bool PeerIsThisProcess(const ITransport* transport);
+    // Test seam: the protocol tests run over an in-process transport and stand for a peer in
+    // another process while this is set.
+    void SetPeerInAnotherProcessForTest(bool asIfCrossProcess);
+
 } // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/InProcessTransport.cpp

@@ -13,6 +13,7 @@
 
 #include <MG_Util/Debug/Log.h>
 
+#include <atomic>
 #include <cerrno>
 #include <chrono>
 #include <condition_variable>
@@ -290,4 +291,17 @@ namespace MobileGL::MG_Remote::Transport {
 
     Doorbell& InProcessTransport::SelfDoorbell() { return m_channel->Bell(m_endpoint); }
 
+    namespace {
+        std::atomic<bool> g_peerInAnotherProcessForTest{false};
+    } // namespace
+
+    bool PeerIsThisProcess(const ITransport* transport) {
+        return transport != nullptr && transport->Role() == TransportRole::InProcess &&
+               !g_peerInAnotherProcessForTest.load(std::memory_order_acquire);
+    }
+
+    void SetPeerInAnotherProcessForTest(bool asIfCrossProcess) {
+        g_peerInAnotherProcessForTest.store(asIfCrossProcess, std::memory_order_release);
+    }
+
 } // namespace MobileGL::MG_Remote::Transport