commit 9b907e440cdff222481abf16def6e03870678c20
author Hugo Benichi <hugobenichi@google.com> Wed Apr 27 16:47:55 2016 +0900
committer Hugo Benichi <hugobenichi@google.com> Wed Apr 27 16:47:55 2016 +0900
tree b622e55b19d1b200e4850459016e71525bd3cede
parent 502094ccbaa8d1f0b0dea9190ca83ea6a9519e34

Fixes 2 race conditions in MetricsLoggerService

- in dump, the array of pending intent was iterated without locking
  against logEvent. This can throw a ConcurrentModificationException
  if at the same time logEvent sends intents and remove them from the
  array.
- in getEvents, the returned reference was reading the reference of the
  last event after releasing the lock on mEvents, which can cause
  callers to miss events if at the same time logEvent is called and
  mLastEventReference is incremented.

Bug: 28204408
Change-Id: I7ff21d4d2c0b02d8e0b47310430dff7d8a87f0bf

services/core/java/com/android/server/connectivity/MetricsLoggerService.java

diff --git a/services/core/java/com/android/server/connectivity/MetricsLoggerService.java b/services/core/java/com/android/server/connectivity/MetricsLoggerService.java
index ac5c4ae..5096b35 100644
--- a/services/core/java/com/android/server/connectivity/MetricsLoggerService.java
+++ b/services/core/java/com/android/server/connectivity/MetricsLoggerService.java
@@ -192,11 +192,13 @@
                 }
             }
 
-            if (!mPendingIntents.isEmpty()) {
-                pw.println();
-                pw.println("Pending intents:");
-                for (PendingIntent pi : mPendingIntents) {
-                    pw.println(pi.toString());
+            synchronized (mPendingIntents) {
+                if (!mPendingIntents.isEmpty()) {
+                    pw.println();
+                    pw.println("Pending intents:");
+                    for (PendingIntent pi : mPendingIntents) {
+                        pw.println(pi.toString());
+                    }
                 }
             }
 
@@ -327,9 +329,9 @@
                         result[i++] = e;
                     }
                 }
-            }
 
-            reference.setValue(mLastEventReference);
+                reference.setValue(mLastEventReference);
+            }
 
             return result;
         }