commit b98050fc043122a5f92addb22a7a702b539d1045
author Mike Ma <yanmin@google.com> Mon Mar 30 13:37:31 2020 -0700
committer Mike Ma <yanmin@google.com> Mon Mar 30 14:44:42 2020 -0700
tree ed41e1d7f6a73ceb3d69f2ca66893cf8e67f0b81
parent 603713009eee83b60939ca0a709026b1f63cad97

Fix a race condition on ReportHandler::mBatch

Hold mLock when accessing mBatch and mHandlerLooper in ReportHandler.

Fixes: 147326028
Test: Take an incident report. Verify no race condition.
Change-Id: I9d6da0067731f253532f60e5abb12dfb238b5411

cmds/incidentd/src/IncidentService.cpp

diff --git a/cmds/incidentd/src/IncidentService.cpp b/cmds/incidentd/src/IncidentService.cpp
index 6c2b855..9e6d0a2 100644
--- a/cmds/incidentd/src/IncidentService.cpp
+++ b/cmds/incidentd/src/IncidentService.cpp
@@ -152,6 +152,7 @@
 }
 
 void ReportHandler::schedulePersistedReport(const IncidentReportArgs& args) {
+    unique_lock<mutex> lock(mLock);
     mBatch->addPersistedReport(args);
     mHandlerLooper->removeMessages(this, WHAT_TAKE_REPORT);
     mHandlerLooper->sendMessage(this, Message(WHAT_TAKE_REPORT));
@@ -159,6 +160,7 @@
 
 void ReportHandler::scheduleStreamingReport(const IncidentReportArgs& args,
         const sp<IIncidentReportStatusListener>& listener, int streamFd) {
+    unique_lock<mutex> lock(mLock);
     mBatch->addStreamingReport(args, listener, streamFd);
     mHandlerLooper->removeMessages(this, WHAT_TAKE_REPORT);
     mHandlerLooper->sendMessage(this, Message(WHAT_TAKE_REPORT));

cmds/incidentd/src/Section.cpp

diff --git a/cmds/incidentd/src/Section.cpp b/cmds/incidentd/src/Section.cpp
index dec9cb0..114cbb8 100644
--- a/cmds/incidentd/src/Section.cpp
+++ b/cmds/incidentd/src/Section.cpp
@@ -755,7 +755,7 @@
         if (stat(link_name, &fileStat) != OK) {
             continue;
         }
-        size_t exe_name_len = readlink(link_name, exe_name, EXE_NAME_LEN);
+        ssize_t exe_name_len = readlink(link_name, exe_name, EXE_NAME_LEN);
         if (exe_name_len < 0 || exe_name_len >= EXE_NAME_LEN) {
             ALOGE("[%s] Can't read '%s': %s", name.string(), link_name, strerror(errno));
             continue;