Fix deadlock in updatePasswordHistory()
One of the changes that commit bd355874 ("Remove unused and insecure fallback to legacy password history hash") (http://ag/19331204) made was moving the call to updatePasswordHistory() into setLockCredentialWithSpLocked() so that the SyntheticPassword became available. Unfortunately, this causes a deadlock because the call to getRequestedPasswordHistoryLength() takes the DevicePolicyManagerService lock while the mSpManager lock is held, whereas normally these two locks are taken in the opposite order. Revert the problematic part of the change and go back to the original implementation where updatePasswordHistory() is called from onPostPasswordChanged(). Handle failure to compute the password hash (which should still never happen, but it becomes less obvious when the SP needs to be unwrapped) by logging an error message and not updating the password history. Test: atest LockscreenCredentialTest Test: atest com.android.server.locksettings Test: atest MixedDeviceOwnerTest#testSecurityLoggingWithSingleUser Bug: 241253969 Fixes: bd355874 ("Remove unused and insecure fallback to legacy password history hash") Change-Id: I210407884a657bc2019d14f59ce56753b3cacd53
Loading
Please register or sign in to comment