Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a8a51b2 authored by chao.bi's avatar chao.bi Committed by Steve Kondik
Browse files

Race in WapPushManager under multi-thread environment 



When multiple threads call WapPushManager functions simultaneously,
it might hit race that one thread is closing a SqliteDatabase object
while another thread is using it.

Following is an example:

    Thread A                                    Thread B

call getDatabaseLocked()                          ---
       |                                           |
mDatabase is NULL,so A create Database            ---
       |                                           |
getDatabaseLocked() return the new                ---
created Database                                  ---
       |                                           |
      ---                                 call getDatabaseLocked() and return
      ---                                 the Database created by A
       |                                           |
Call SQLiteDatabase.close()                       ---
close() -> releaseReference()                     ---
the reference count is decreased to 0             ---
       |                                           |
      ---                                  Attempt to call any operation of Database
      ---                                  Object, but hit exception because this
      ---                                  Database Object's reference count is 0

For WapPushManager, seems it always close the database object right after
it open&query it, this is not necessary and would hit above race under multi-thread
environment.

Change-Id: I68fac046f806c8d9328fbe0d9c8a08e6bfddbef1
Signed-off-by: default avatarwangbo3 <bo.c.wang@intel.com>
Signed-off-by: default avatarchao.bi <chao.bi@intel.com>
Signed-off-by: default avatarZhiquan Liu <zhiquan.liu@intel.com>
parent 15e7a215

packages/WAPPushManager/src/com/android/smspush/WapPushManager.java

+0 −7
Original line number Diff line number Diff line
@@ -185,7 +185,6 @@ public class WapPushManager extends Service { 
            WapPushManDBHelper dbh = getDatabase(mContext);

            SQLiteDatabase db = dbh.getReadableDatabase();

            WapPushManDBHelper.queryData lastapp = dbh.queryLastApp(db, app_id, content_type);

            db.close();



            if (lastapp == null) {

                Log.w(LOG_TAG, "no receiver app found for " + app_id + ":" + content_type);
@@ -284,7 +283,6 @@ public class WapPushManager extends Service { 
                ret = true;

            }



            db.close();



            return ret;

        }
@@ -308,7 +306,6 @@ public class WapPushManager extends Service { 
            WapPushManDBHelper.queryData lastapp = dbh.queryLastApp(db, x_app_id, content_type);



            if (lastapp == null) {

                db.close();

                return false;

            }
@@ -328,7 +325,6 @@ public class WapPushManager extends Service { 
                    + package_name + "." + class_name

                    + ", sq:" + lastapp.installOrder);



            db.close();



            return num > 0;

        }
@@ -346,7 +342,6 @@ public class WapPushManager extends Service { 
                    + " and class_name=\'" + class_name + "\'";

            int num_removed = db.delete(APPID_TABLE_NAME, where, null);



            db.close();

            if (LOCAL_LOGV) Log.v(LOG_TAG, "deleted " + num_removed + " rows:"

                    + x_app_id + ":" + content_type + " "

                    + package_name + "." + class_name);
@@ -399,7 +394,6 @@ public class WapPushManager extends Service { 
        if (LOCAL_LOGV) Log.v(LOG_TAG, "verifyData app id: " + x_app_id + " content type: " +

                content_type + " lastapp: " + lastapp);



        db.close();



        if (lastapp == null) return false;
@@ -430,7 +424,6 @@ public class WapPushManager extends Service { 
        SQLiteDatabase db = dbh.getReadableDatabase();

        boolean ret = dbh.queryLastApp(db, x_app_id, content_type) != null;



        db.close();

        return ret;

    }