commit f786f8914a07e3e0519018429bb88f4e604cf20a
author Benedict Wong <benedictwong@google.com> Tue Apr 09 11:31:46 2019 -0700
committer Benedict Wong <benedictwong@google.com> Tue Apr 09 21:37:26 2019 +0000
tree a5b8f57f0f62920aef79c6a2ae111e84c4dbd31d
parent 587caa5aa8299114cf31df9ebbd2632dee33ee68

Fix remove-before-add for IpSecService RefcountedResource

This patch fixes a bug where if a binder dies before the linkToDeath
call, the cleanup will be performed before the entry is added to the
array. While it is safe in that quotas and tracking performs as per
normal, the RefcountedRecord may not be cleaned up.

Rethrowing this exception is safe, since the only paths that would hit
this are all on binder threads coming from applications. Further, it
seems there is only one real way of this getting hit - if the app that
called the creation died during the binder call.

Bug: 126802451
Test: Compiled, CTS tests passing
Change-Id: Ib955acaa5e498c0e977cb5f2e48cffbc9fea8c7c
Merged-In: I6db75853da9f29e1573512e26351623f22770c5d
Merged-In: I416c2e43961ec0e1cc6b2fbcef970fbce858603b
Merged-In: Ib955acaa5e498c0e977cb5f2e48cffbc9fea8c7c
(cherry picked from commit c206dde1bdfadb09939f415cf8c0689f24918e03)

services/core/java/com/android/server/IpSecService.java

diff --git a/services/core/java/com/android/server/IpSecService.java b/services/core/java/com/android/server/IpSecService.java
index 2cfcecc..2055b64 100644
--- a/services/core/java/com/android/server/IpSecService.java
+++ b/services/core/java/com/android/server/IpSecService.java
@@ -208,6 +208,7 @@
                     mBinder.linkToDeath(this, 0);
                 } catch (RemoteException e) {
                     binderDied();
+                    e.rethrowFromSystemServer();
                 }
             }
         }