From 07dbd63153b523f960eb7052a852661303aa7eac Mon Sep 17 00:00:00 2001
From: Jim Miller <jaggies@google.com>
Date: Tue, 5 Apr 2016 18:22:30 -0700
Subject: [PATCH] Track userId independently from callback for
 fingerprint.remove().

If we get an extremely delayed response from the fingerprint
hardware or the system crashes, it was possible to get into
a state where we have no remove ClientMonitor and FingerprintService
would crash.

The fix is to track the userId for removal independently
from the callback.

Fixes bug 28028434

Change-Id: I2b3e3eb332ea5512b86d3f7be853b720e41318a4
---
 .../server/fingerprint/FingerprintService.java       | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/fingerprint/FingerprintService.java b/services/core/java/com/android/server/fingerprint/FingerprintService.java
index 7b134cab2b959..7ba030f78b9bd 100644
--- a/services/core/java/com/android/server/fingerprint/FingerprintService.java
+++ b/services/core/java/com/android/server/fingerprint/FingerprintService.java
@@ -107,6 +107,7 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
     private static final int FINGERPRINT_ACQUIRED_GOOD = 0;
     private final String mKeyguardPackage;
     private int mCurrentUserId = UserHandle.USER_CURRENT;
+    private int mUserIdForRemove = UserHandle.USER_NULL;
 
     Handler mHandler = new Handler() {
         @Override
@@ -205,10 +206,12 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
     protected void handleRemoved(long deviceId, int fingerId, int groupId) {
         final ClientMonitor client = mRemoveClient;
         if (fingerId != 0) {
-            removeTemplateForUser(mRemoveClient, fingerId);
+            removeTemplateForUser(mUserIdForRemove, fingerId);
+        } else {
+            mUserIdForRemove = UserHandle.USER_NULL;
         }
         if (client != null && client.sendRemoved(fingerId, groupId)) {
-            removeClient(mRemoveClient);
+            removeClient(client);
         }
     }
 
@@ -325,8 +328,8 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
         return false;
     }
 
-    private void removeTemplateForUser(ClientMonitor clientMonitor, int fingerId) {
-        mFingerprintUtils.removeFingerprintIdForUser(mContext, fingerId, clientMonitor.userId);
+    private void removeTemplateForUser(int userId, int fingerId) {
+        mFingerprintUtils.removeFingerprintIdForUser(mContext, fingerId, userId);
     }
 
     private void addTemplateForUser(ClientMonitor clientMonitor, int fingerId) {
@@ -488,6 +491,7 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
 
         stopPendingOperations(true);
         mRemoveClient = new ClientMonitor(token, receiver, userId, restricted, token.toString());
+        mUserIdForRemove = mCurrentUserId;
         // The fingerprint template ids will be removed when we get confirmation from the HAL
         try {
             final int result = daemon.remove(fingerId, userId);