From 614b27badd29a2a77e120662f9e5bcf899e3393b Mon Sep 17 00:00:00 2001 From: Tyler Wear Date: Thu, 19 Aug 2021 09:33:26 -0700 Subject: [PATCH] Check NetworkAgentInfo Map Before Destroying Network updateNetworkInfo is called with the argument in a message, which is initialized with `this` in NetworkAgentRegistry. That means it's technically possible that CS calls tearDownUnneededNetwork, calling nai.disconnect() and queuing up a message to call this, but before it's done the NA calls sendNetworkInfo with DISCONNECTED, which never looks up the agent from the map. Throwing a ServiceSpecificException and resulting in a System crash. Bug: 196423147 Change-Id: Ia52f2b794f32c263200c14b8dc2eb6b184bff5ff --- service/src/com/android/server/ConnectivityService.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java index 34e15ca547..d9fe42894f 100644 --- a/service/src/com/android/server/ConnectivityService.java +++ b/service/src/com/android/server/ConnectivityService.java @@ -3844,9 +3844,7 @@ public class ConnectivityService extends IConnectivityManager.Stub private void handleNetworkAgentDisconnected(Message msg) { NetworkAgentInfo nai = (NetworkAgentInfo) msg.obj; - if (mNetworkAgentInfos.contains(nai)) { - disconnectAndDestroyNetwork(nai); - } + disconnectAndDestroyNetwork(nai); } // Destroys a network, remove references to it from the internal state managed by @@ -3854,6 +3852,9 @@ public class ConnectivityService extends IConnectivityManager.Stub // Must be called on the Handler thread. private void disconnectAndDestroyNetwork(NetworkAgentInfo nai) { ensureRunningOnConnectivityServiceThread(); + + if (!mNetworkAgentInfos.contains(nai)) return; + if (DBG) { log(nai.toShortString() + " disconnected, was satisfying " + nai.numNetworkRequests()); } @@ -3939,7 +3940,7 @@ public class ConnectivityService extends IConnectivityManager.Stub try { mNetd.networkSetPermissionForNetwork(nai.network.netId, INetd.PERMISSION_SYSTEM); } catch (RemoteException e) { - Log.d(TAG, "Error marking network restricted during teardown: " + e); + Log.d(TAG, "Error marking network restricted during teardown: ", e); } mHandler.postDelayed(() -> destroyNetwork(nai), nai.teardownDelayMs); }