Fix race conditions in NdefPushServer.

Exposed by the new stack; need to take locks around
mRunning and mLlcpServerSocket.

Bug: 6922853
Change-Id: Ic8e3b90d1a1c9d77b27308e3f18bf8871843206f

1 files changed, 48 insertions, 19 deletions

diff --git a/src/com/android/nfc/ndefpush/NdefPushServer.java b/src/com/android/nfc/ndefpush/NdefPushServer.java
index ca58a67..bf92c17 100755
--- a/src/com/android/nfc/ndefpush/NdefPushServer.java
+++ b/src/com/android/nfc/ndefpush/NdefPushServer.java
@@ -117,28 +117,49 @@ public class NdefPushServer {
 
     /** Server class, used to listen for incoming connection request */
     class ServerThread extends Thread {
+        // Variables below synchronized on NdefPushServer.this
         boolean mRunning = true;
         LlcpServerSocket mServerSocket;
 
         @Override
         public void run() {
-            while (mRunning) {
+            boolean threadRunning;
+            synchronized (NdefPushServer.this) {
+                threadRunning = mRunning;
+            }
+            while (threadRunning) {
                 if (DBG) Log.d(TAG, "about create LLCP service socket");
                 try {
-                    mServerSocket = mService.createLlcpServerSocket(mSap, SERVICE_NAME,
-                            MIU, 1, 1024);
+                    synchronized (NdefPushServer.this) {
+                        mServerSocket = mService.createLlcpServerSocket(mSap, SERVICE_NAME,
+                                MIU, 1, 1024);
+                    }
                     if (mServerSocket == null) {
                         if (DBG) Log.d(TAG, "failed to create LLCP service socket");
                         return;
                     }
                     if (DBG) Log.d(TAG, "created LLCP service socket");
-                    while (mRunning) {
+                    synchronized (NdefPushServer.this) {
+                        threadRunning = mRunning;
+                    }
+
+                    while (threadRunning) {
+                        LlcpServerSocket serverSocket;
+                        synchronized (NdefPushServer.this) {
+                            serverSocket = mServerSocket;
+                        }
+                        if (serverSocket == null) return;
+
                         if (DBG) Log.d(TAG, "about to accept");
-                        LlcpSocket communicationSocket = mServerSocket.accept();
+                        LlcpSocket communicationSocket = serverSocket.accept();
                         if (DBG) Log.d(TAG, "accept returned " + communicationSocket);
                         if (communicationSocket != null) {
                             new ConnectionThread(communicationSocket).start();
                         }
+
+                        synchronized (NdefPushServer.this) {
+                            threadRunning = mRunning;
+                        }
                     }
                     if (DBG) Log.d(TAG, "stop running");
                 } catch (LlcpException e) {
@@ -146,28 +167,36 @@ public class NdefPushServer {
                 } catch (IOException e) {
                     Log.e(TAG, "IO error", e);
                 } finally {
-                    if (mServerSocket != null) {
-                        if (DBG) Log.d(TAG, "about to close");
-                        try {
-                            mServerSocket.close();
-                        } catch (IOException e) {
-                            // ignore
+                    synchronized (NdefPushServer.this) {
+                        if (mServerSocket != null) {
+                            if (DBG) Log.d(TAG, "about to close");
+                            try {
+                                mServerSocket.close();
+                            } catch (IOException e) {
+                                // ignore
+                            }
+                            mServerSocket = null;
                         }
-                        mServerSocket = null;
                     }
                 }
+
+                synchronized (NdefPushServer.this) {
+                    threadRunning = mRunning;
+                }
             }
         }
 
         public void shutdown() {
-            mRunning = false;
-            if (mServerSocket != null) {
-                try {
-                    mServerSocket.close();
-                } catch (IOException e) {
-                    // ignore
+            synchronized (NdefPushServer.this) {
+                mRunning = false;
+                if (mServerSocket != null) {
+                    try {
+                        mServerSocket.close();
+                    } catch (IOException e) {
+                        // ignore
+                    }
+                    mServerSocket = null;
                 }
-                mServerSocket = null;
             }
         }
     }