Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c756987 authored by Anthony Stange's avatar Anthony Stange
Browse files

Synchronize access to mCallbacksList 

If a transaction timeout occurs while another callback is being invoked,
it's possible that a race condition will occur where beginBroadcast will
be invoked twice which will cause a crash.

Fixes: 229657469
Test: PTS
Change-Id: I713c3f978a98f3db1d109233bb4ee1c0ab60557c
parent 05e028e1

services/core/java/com/android/server/location/contexthub/ContextHubService.java

+24 −20
Original line number Diff line number Diff line
@@ -1058,11 +1058,14 @@ public class ContextHubService extends IContextHubService.Stub { 
        }



        int msgVersion = 0;

        // Synchronize access to mCallbacksList to prevent more than one outstanding broadcast as

        // that will cause a crash.

        synchronized (mCallbacksList) {

            int callbacksCount = mCallbacksList.beginBroadcast();

            if (DEBUG_LOG_ENABLED) {

            Log.v(TAG, "Sending message " + msgType + " version " + msgVersion + " from hubHandle "

                    + contextHubHandle + ", appInstance " + appInstance + ", callBackCount "

                    + callbacksCount);

                Log.v(TAG, "Sending message " + msgType + " version " + msgVersion

                        + " from hubHandle " + contextHubHandle + ", appInstance " + appInstance

                        + ", callBackCount " + callbacksCount);

            }



            if (callbacksCount < 1) {
@@ -1083,6 +1086,7 @@ public class ContextHubService extends IContextHubService.Stub { 
                }

            }

            mCallbacksList.finishBroadcast();

        }

        return 0;

    }