Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5814ae95 authored by JW Wang's avatar JW Wang
Browse files

Fix a data race 

* mPendingVerification should only be accessed in the handler thread.
* Add comments to note the thread invariants of the fields.

Bug: 204963930
Test: m
Change-Id: I322ff9d35bb2a603bc34a1dd3536cb0d1edeb9a7
parent ce8bd1e3

services/core/java/com/android/server/pm/PackageManagerService.java

+35 −20
Original line number Diff line number Diff line
@@ -806,10 +806,16 @@ public class PackageManagerService extends IPackageManager.Stub 
    @GuardedBy("mProtectedBroadcasts")

    final ArraySet<String> mProtectedBroadcasts = new ArraySet<>();



    /** List of packages waiting for verification. */

    /**

     * List of packages waiting for verification.

     * Handler thread only!

     */

    final SparseArray<PackageVerificationState> mPendingVerification = new SparseArray<>();



    /** List of packages waiting for rollback to be enabled. */

    /**

     * List of packages waiting for rollback to be enabled.

     * Handler thread only!

     */

    final SparseArray<VerificationParams> mPendingEnableRollback = new SparseArray<>();



    final PackageInstallerService mInstallerService;
@@ -830,10 +836,16 @@ public class PackageManagerService extends IPackageManager.Stub 
    // Cache of users who need badging.

    private final SparseBooleanArray mUserNeedsBadging = new SparseBooleanArray();



    /** Token for keys in mPendingVerification. */

    /**

     * Token for keys in mPendingVerification.

     * Handler thread only!

     */

    int mPendingVerificationToken = 0;



    /** Token for keys in mPendingEnableRollback. */

    /**

     * Token for keys in mPendingEnableRollback.

     * Handler thread only!

     */

    int mPendingEnableRollbackToken = 0;



    @Watched(manual = true)
@@ -6357,15 +6369,17 @@ public class PackageManagerService extends IPackageManager.Stub 
                android.Manifest.permission.PACKAGE_VERIFICATION_AGENT,

                "Only package verification agents can extend verification timeouts");



        mHandler.post(() -> {

            final PackageVerificationState state = mPendingVerification.get(id);

            final PackageVerificationResponse response = new PackageVerificationResponse(

                    verificationCodeAtTimeout, Binder.getCallingUid());



        if (millisecondsToDelay > PackageManager.MAXIMUM_VERIFICATION_TIMEOUT) {

            millisecondsToDelay = PackageManager.MAXIMUM_VERIFICATION_TIMEOUT;

            long delay = millisecondsToDelay;

            if (delay > PackageManager.MAXIMUM_VERIFICATION_TIMEOUT) {

                delay = PackageManager.MAXIMUM_VERIFICATION_TIMEOUT;

            }

        if (millisecondsToDelay < 0) {

            millisecondsToDelay = 0;

            if (delay < 0) {

                delay = 0;

            }



            if ((state != null) && !state.timeoutExtended()) {
@@ -6374,8 +6388,9 @@ public class PackageManagerService extends IPackageManager.Stub 
                final Message msg = mHandler.obtainMessage(PACKAGE_VERIFIED);

                msg.arg1 = id;

                msg.obj = response;

            mHandler.sendMessageDelayed(msg, millisecondsToDelay);

                mHandler.sendMessageDelayed(msg, delay);

            }

        });

    }



    private void setEnableRollbackCode(int token, int enableRollbackCode) {