Fix issue #5595933: GREF leak due to race condition in...

...LoadedApk.ServiceDispatcher.connected , LoadedApk.forgetServiceDispatcher

Don't be stupid if we receive a new binding to a ServiceConnection after it
has already been unbound.

Change-Id: I85a49de97372bf9af55542a89031f0b7a2ac8fbb

1 files changed, 7 insertions, 0 deletions

diff --git a/core/java/android/app/LoadedApk.java b/core/java/android/app/LoadedApk.java
index 522f477..0c6baeb 100644
--- a/core/java/android/app/LoadedApk.java
+++ b/core/java/android/app/LoadedApk.java
@@ -901,6 +901,7 @@ public final class LoadedApk {
         private RuntimeException mUnbindLocation;
 
         private boolean mDied;
+        private boolean mForgotten;
 
         private static class ConnectionInfo {
             IBinder binder;
@@ -959,6 +960,7 @@ public final class LoadedApk {
                     ci.binder.unlinkToDeath(ci.deathMonitor, 0);
                 }
                 mActiveConnections.clear();
+                mForgotten = true;
             }
         }
 
@@ -1020,6 +1022,11 @@ public final class LoadedApk {
             ServiceDispatcher.ConnectionInfo info;
 
             synchronized (this) {
+                if (mForgotten) {
+                    // We unbound before receiving the connection; ignore
+                    // any connection received.
+                    return;
+                }
                 old = mActiveConnections.get(name);
                 if (old != null && old.binder == service) {
                     // Huh, already have this one.  Oh well!