Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66c9fc0e authored by Eric Biggers's avatar Eric Biggers
Browse files

Always call tieProfileLockIfNecessary() under mSpManager lock 

tieProfileLockIfNecessary() runs under the mSpManager lock when a user's
LSKF is changed, but not when it's executed by onUserUnlocking().  In
the latter case, a race is possible where tieProfileLockToParent() tries
to generate an auth-bound key for a parent user whose LSKF has just been
removed by a concurrent thread.  This fails and throws an exception,
crashing system_server.  Fix this by ensuring that the mSpManager lock
is always held during tieProfileLockIfNecessary().

Bug: 355905501
Flag: android.app.admin.flags.fix_race_condition_in_tie_profile_lock
Test: atest FrameworksServicesTests:com.android.server.locksettings
Test: atest CtsDevicePolicyTestCases # 6 test cases failed both before and after
Change-Id: I5f8c1bcc206460c1480ce58c846e32d91898c4ce
parent 1c2e64ab

core/java/android/app/admin/flags/flags.aconfig

+10 −0
Original line number Original line Diff line number Diff line
@@ -99,6 +99,16 @@ flag { 
    bug: "323001115"

    bug: "323001115"

}

}





flag {

  name: "fix_race_condition_in_tie_profile_lock"

  namespace: "enterprise"

  description: "Fix race condition in tieProfileLockIfNecessary()"

  bug: "355905501"

  metadata {

    purpose: PURPOSE_BUGFIX

  }

}



flag {

flag {

  name: "quiet_mode_credential_bug_fix"

  name: "quiet_mode_credential_bug_fix"

  namespace: "enterprise"

  namespace: "enterprise"

services/core/java/com/android/server/locksettings/LockSettingsService.java

+15 −3
Original line number Original line Diff line number Diff line
@@ -879,10 +879,16 @@ public class LockSettingsService extends ILockSettings.Stub { 
                // Hide notification first, as tie profile lock takes time

                // Hide notification first, as tie profile lock takes time

                hideEncryptionNotification(new UserHandle(userId));

                hideEncryptionNotification(new UserHandle(userId));





                if (android.app.admin.flags.Flags.fixRaceConditionInTieProfileLock()) {

                    synchronized (mSpManager) {

                        tieProfileLockIfNecessary(userId, LockscreenCredential.createNone());

                    }

                } else {

                    if (isCredentialSharableWithParent(userId)) {

                    if (isCredentialSharableWithParent(userId)) {

                        tieProfileLockIfNecessary(userId, LockscreenCredential.createNone());

                        tieProfileLockIfNecessary(userId, LockscreenCredential.createNone());

                    }

                    }

                }

                }

            }

        });

        });

    }

    }
@@ -1245,8 +1251,14 @@ public class LockSettingsService extends ILockSettings.Stub { 
                mStorage.removeChildProfileLock(userId);

                mStorage.removeChildProfileLock(userId);

                removeKeystoreProfileKey(userId);

                removeKeystoreProfileKey(userId);

            } else {

            } else {

                if (android.app.admin.flags.Flags.fixRaceConditionInTieProfileLock()) {

                    synchronized (mSpManager) {

                        tieProfileLockIfNecessary(userId, profileUserPassword);

                        tieProfileLockIfNecessary(userId, profileUserPassword);

                    }

                    }

                } else {

                    tieProfileLockIfNecessary(userId, profileUserPassword);

                }

            }

        } catch (IllegalStateException e) {

        } catch (IllegalStateException e) {

            setBoolean(SEPARATE_PROFILE_CHALLENGE_KEY, old, userId);

            setBoolean(SEPARATE_PROFILE_CHALLENGE_KEY, old, userId);

            throw e;

            throw e;