From 98ddbe50852c03556625c1f5a0c56241f978d91a Mon Sep 17 00:00:00 2001
From: Rubin Xu <rubinxu@google.com>
Date: Fri, 28 Apr 2023 20:51:42 +0100
Subject: [PATCH] Always clear password reset token when removing device owner

Move the token removal logic inside clearDeviceOwnerLocked so
it's executed by all paths where DO is removed. This also fixes
a bug where mLockPatternUtils.removeEscrowToken is throwing
exception due to it's not inside a clear binder identity block.

Bug: 280093211
Test: DeviceOwnerTest#clearDeviceOwnerApp_escrowTokenExists_success
Change-Id: Ifaa1ffbd0f29b62fd05a9d746c26b44c52f4eaa0
---
 .../server/devicepolicy/DevicePolicyManagerService.java   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 7388c766f1f2f..8dbe9d65d38e7 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -9832,10 +9832,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                         "clearDeviceOwner can only be called by the device owner");
             }
             enforceUserUnlocked(deviceOwnerUserId);
-            DevicePolicyData policy = getUserData(deviceOwnerUserId);
-            if (policy.mPasswordTokenHandle != 0) {
-                mLockPatternUtils.removeEscrowToken(policy.mPasswordTokenHandle, deviceOwnerUserId);
-            }
 
             final ActiveAdmin admin = getDeviceOwnerAdminLocked();
             mInjector.binderWithCleanCallingIdentity(() -> {
@@ -9890,6 +9886,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
         final DevicePolicyData policyData = getUserData(userId);
         policyData.mCurrentInputMethodSet = false;
+        if (policyData.mPasswordTokenHandle != 0) {
+            mLockPatternUtils.removeEscrowToken(policyData.mPasswordTokenHandle, userId);
+            policyData.mPasswordTokenHandle = 0;
+        }
         saveSettingsLocked(userId);
         mPolicyCache.onUserRemoved(userId);
         final DevicePolicyData systemPolicyData = getUserData(UserHandle.USER_SYSTEM);