Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07dbd631 authored by Jim Miller's avatar Jim Miller
Browse files

Track userId independently from callback for fingerprint.remove(). 

If we get an extremely delayed response from the fingerprint
hardware or the system crashes, it was possible to get into
a state where we have no remove ClientMonitor and FingerprintService
would crash.

The fix is to track the userId for removal independently
from the callback.

Fixes bug 28028434

Change-Id: I2b3e3eb332ea5512b86d3f7be853b720e41318a4
parent 1314d087

services/core/java/com/android/server/fingerprint/FingerprintService.java

+8 −4
Original line number Diff line number Diff line
@@ -107,6 +107,7 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe 
    private static final int FINGERPRINT_ACQUIRED_GOOD = 0;

    private final String mKeyguardPackage;

    private int mCurrentUserId = UserHandle.USER_CURRENT;

    private int mUserIdForRemove = UserHandle.USER_NULL;



    Handler mHandler = new Handler() {

        @Override
@@ -205,10 +206,12 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe 
    protected void handleRemoved(long deviceId, int fingerId, int groupId) {

        final ClientMonitor client = mRemoveClient;

        if (fingerId != 0) {

            removeTemplateForUser(mRemoveClient, fingerId);

            removeTemplateForUser(mUserIdForRemove, fingerId);

        } else {

            mUserIdForRemove = UserHandle.USER_NULL;

        }

        if (client != null && client.sendRemoved(fingerId, groupId)) {

            removeClient(mRemoveClient);

            removeClient(client);

        }

    }
@@ -325,8 +328,8 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe 
        return false;

    }



    private void removeTemplateForUser(ClientMonitor clientMonitor, int fingerId) {

        mFingerprintUtils.removeFingerprintIdForUser(mContext, fingerId, clientMonitor.userId);

    private void removeTemplateForUser(int userId, int fingerId) {

        mFingerprintUtils.removeFingerprintIdForUser(mContext, fingerId, userId);

    }



    private void addTemplateForUser(ClientMonitor clientMonitor, int fingerId) {
@@ -488,6 +491,7 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe 


        stopPendingOperations(true);

        mRemoveClient = new ClientMonitor(token, receiver, userId, restricted, token.toString());

        mUserIdForRemove = mCurrentUserId;

        // The fingerprint template ids will be removed when we get confirmation from the HAL

        try {

            final int result = daemon.remove(fingerId, userId);