From 35a976ff7ac6dafad12c8a60e8e350bf35d215c7 Mon Sep 17 00:00:00 2001
From: Jacob Hobbie <jacobhobbie@google.com>
Date: Wed, 26 Apr 2023 22:59:46 +0000
Subject: [PATCH] Stop lock on GMSCore crashloop

Currently, there is a way for the device to start locking when there is
a crash loop by granting trust when the phone unlocks and then
immediately GMS Core crashes. Since the time that this happens, we're
only upgrading trust, not actually unlocking the phone with trust, it
doesn't make sense that we allow revokeTrust to lock the phone. This
change stops that by setting the security window trigger to only happen
when we're actually unlocked by grant.

Fixes: 279608920
Test: tested manually
Change-Id: I9e6dfc991d81d75842d198b1b20d63360f44863e
---
 .../java/com/android/server/trust/TrustAgentWrapper.java | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/trust/TrustAgentWrapper.java b/services/core/java/com/android/server/trust/TrustAgentWrapper.java
index f971db9b5f0eb..e796275c53e3d 100644
--- a/services/core/java/com/android/server/trust/TrustAgentWrapper.java
+++ b/services/core/java/com/android/server/trust/TrustAgentWrapper.java
@@ -161,7 +161,13 @@ public class TrustAgentWrapper {
                     mDisplayTrustGrantedMessage = (flags & FLAG_GRANT_TRUST_DISPLAY_MESSAGE) != 0;
                     if ((flags & FLAG_GRANT_TRUST_TEMPORARY_AND_RENEWABLE) != 0) {
                         mWaitingForTrustableDowngrade = true;
-                        setSecurityWindowTimer();
+                        resultCallback.thenAccept(result -> {
+                            if (result.getStatus() == GrantTrustResult.STATUS_UNLOCKED_BY_GRANT) {
+                                // if we are not unlocked by grantTrust, then we don't need to
+                                // have the timer for the security window
+                                setSecurityWindowTimer();
+                            }
+                        });
                     } else {
                         mWaitingForTrustableDowngrade = false;
                     }
@@ -562,6 +568,7 @@ public class TrustAgentWrapper {
      * @see android.service.trust.TrustAgentService#onDeviceLocked()
      */
     public void onDeviceLocked() {
+        mWithinSecurityLockdownWindow = false;
         try {
             if (mTrustAgentService != null) mTrustAgentService.onDeviceLocked();
         } catch (RemoteException e) {