StrictMode: fix race condition in onVmPolicyViolation
There's a TOCTOU race condition in onVmPolicyViolation() that can cause a NullPointerException if multiple threads trigger a violation and a penalty listener is set. For example: 1. Thread 1 passes the mCallbackExecutor null check and calls execute() 2. T2 passes the same check and then gets preempted 3. Runnable queued by T1 temporarily replaces sVmPolicy with LAX (which has a null executor) by calling allowVmViolations() 4. T2 calls execute() on sVmPolicy.mCallbackExecutor, which is now null Fix it by using the same VmPolicy object throughout onVmPolicyViolation. Test: atest StrictModeTest Change-Id: Ifa20253ea936b8d3d8c3719c3278bfaccbdf8275
Loading
Please register or sign in to comment