Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a5a791d authored by Daniel Norman's avatar Daniel Norman
Browse files

Remove disabled a11yservices from the binding services list. 

This could cause race conditions if a service connection is exited after
starting binding but before finishing binding.
If the service is mid-initialization when it gets disabled then there is
already logic to prevent full initialization and to exit the connection.

Bug: 252884894
Test: atest AccessibilityPrivacySourceTest --iterations 30
Change-Id: Ib5aa761bb4c9189df53d04d7dc5329aece650141
parent ab707471

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+1 −1
Original line number Diff line number Diff line
@@ -4142,7 +4142,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub 
                    if (readEnabledAccessibilityServicesLocked(userState)) {

                        mSecurityPolicy.onEnabledServicesChangedLocked(userState.mUserId,

                                userState.mEnabledServices);

                        userState.updateCrashedServicesIfNeededLocked();

                        userState.removeDisabledServicesFromTemporaryStatesLocked();

                        onUserStateChangedLocked(userState);

                    }

                } else if (mTouchExplorationGrantedAccessibilityServicesUri.equals(uri)) {

services/accessibility/java/com/android/server/accessibility/AccessibilityUserState.java

+9 −5
Original line number Diff line number Diff line
@@ -381,18 +381,22 @@ class AccessibilityUserState { 
    }



    /**

     * Remove service from crashed service list if users disable it.

     * Remove the service from the crashed and binding service lists if the user disabled it.

     */

    void updateCrashedServicesIfNeededLocked() {

    void removeDisabledServicesFromTemporaryStatesLocked() {

        for (int i = 0, count = mInstalledServices.size(); i < count; i++) {

            final AccessibilityServiceInfo installedService = mInstalledServices.get(i);

            final ComponentName componentName = ComponentName.unflattenFromString(

                    installedService.getId());



            if (mCrashedServices.contains(componentName)

                    && !mEnabledServices.contains(componentName)) {

                // Remove it from mCrashedServices since users toggle the switch bar to retry.

            if (!mEnabledServices.contains(componentName)) {

                // Remove from mCrashedServices, since users may toggle the on/off switch to retry.

                mCrashedServices.remove(componentName);

                // Remove from mBindingServices, since services can get stuck in the binding state

                // if binding starts but never finishes. If the service later attempts to finish

                // binding but it is not in the enabled list then it will exit before initializing;

                // see AccessibilityServiceConnection#initializeService().

                mBindingServices.remove(componentName);

            }

        }

    }