tree a9266ade5438f4da5156e60b23498946d41d51b2
parent 23a3c612893597b2c1d6507ef9c94ae25f8cdcbe
author Edwin Wong <edwinwong@google.com> 1612425788 -0800
committer Edwin Wong <edwinwong@google.com> 1615226254 +0000

[RESTRICT AUTOMERGE] Fix possible uaf of play policy state

Access to the play policy state may happen after
the state is freed in a race condition, which will
result in a SIGARBT.

SafetyNet logging is not added to avoid log spamming.
queryKeyStatus can be called often.

The crash was reproduced on the device before the fix.
Verified the test passes after the fix.

Test: sts-tradefed
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176486806#testPocBug_176486806

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176486806_sts64

Test: sts-tradefed
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176444154#testPocBug_176444154

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176444154_sts64

Bug: 176444154
Bug: 176486806
Change-Id: I07cc93c255942d56e866d0b08fb786f154f6e0d3
Merged-In: I07cc93c255942d56e866d0b08fb786f154f6e0d3