tree 300424e9f3ee98dddc5b354f78116e865e0988ae
parent 69fbdff0ed3303bcc74a93440a42063eb2df0f90
author Chalard Jean <jchalard@google.com> 1627361692 +0000
committer Chalard Jean <jchalard@google.com> 1627448179 +0000

Fix a possible system server crash

The scenario is as follows : an app registers a network callback,
then unregisters it and dies immediately after. In this scenario,
the system server will receive a notification of the binder death
and enqueue a call to handleRemoveNetworkRequest. If the callback
unregister message has been process first, this call would result
in unlinkToDeath being called twice on the same Binder, crashing.
This patch fixes the problem by using handleReleaseNetworkRequest
instead of Remove, which looks up the NRI in a map on the handler
thread before calling Remove, returning without doing anything if
the NRI has already been removed.

Test: ConnectivityServiceTest
Test: New test for this
Bug: 194394697
Merged-In: I82a28c37450146838410bf5a059aac295a985fca
Change-Id: Iddab205cf2754d326be816e6e8e92c2cc0b95771
(cherry picked from commit d79bd5c622d7a76b37a71f8f131697cba079c6e9)