From 6f7d92c926c327b209afebbe75cd64eacd24ea83 Mon Sep 17 00:00:00 2001
From: Rambo Wang <rambowang@google.com>
Date: Fri, 29 Apr 2022 03:55:50 +0000
Subject: [PATCH] Fix race condition when TelephonyRegistry handles multi-SIM
 config change

TelephonyRegistry only updates some internal statuses related to
active modem count after receiving ACTION_MULTI_SIM_CONFIG_CHANGED.
If another component receives the same intent firstly and calls
TelephonyRegistryManager to either register or notify an event,
the internal status related to active modem count may not be able
to update yet, causing IAE saying e.g. phoneId is invalid.

To fix the issue, onMultiSimConfigChanged will be called to update
the internal statuses firstly before accessing them.

Bug: 230799289
Fix: 230773760
Test: atest TelephonyRegistryTest
Test: manual DS<->SS switching test
Merged-In: I31506a07406dee424546bfe4927e069280a7b011
Change-Id: I31506a07406dee424546bfe4927e069280a7b011
(cherry picked from commit 80b47e83f631b37cc72fbefc3686714672e1ef04)
---
 .../com/android/server/TelephonyRegistry.java | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/TelephonyRegistry.java b/services/core/java/com/android/server/TelephonyRegistry.java
index 2bb3952a346bf..724d17bac8e02 100644
--- a/services/core/java/com/android/server/TelephonyRegistry.java
+++ b/services/core/java/com/android/server/TelephonyRegistry.java
@@ -2808,6 +2808,11 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
             throw new IllegalArgumentException("Invalid slot index: " + phoneId);
         }
 
+        // In case this is triggered from the caller who has handled multiple SIM config change
+        // firstly, we need to update the status (mNumPhone and mCarrierPrivilegeStates) firstly.
+        // This is almost a no-op if there is no multiple SIM config change in advance.
+        onMultiSimConfigChanged();
+
         synchronized (mRecords) {
             Record r = add(
                     callback.asBinder(), Binder.getCallingUid(), Binder.getCallingPid(), false);
@@ -2868,6 +2873,12 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
                             + ", <packages=" + pii(privilegedPackageNames)
                             + ", uids=" + Arrays.toString(privilegedUids) + ">");
         }
+
+        // In case this is triggered from the caller who has handled multiple SIM config change
+        // firstly, we need to update the status (mNumPhone and mCarrierPrivilegeStates) firstly.
+        // This is almost a no-op if there is no multiple SIM config change in advance.
+        onMultiSimConfigChanged();
+
         synchronized (mRecords) {
             mCarrierPrivilegeStates.set(
                     phoneId, new Pair<>(privilegedPackageNames, privilegedUids));
@@ -2900,6 +2911,11 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
                     + ", package=" + pii(packageName) + ", uid=" + uid);
         }
 
+        // In case this is triggered from the caller who has handled multiple SIM config change
+        // firstly, we need to update the status (mNumPhone and mCarrierServiceStates) firstly.
+        // This is almost a no-op if there is no multiple SIM config change in advance.
+        onMultiSimConfigChanged();
+
         synchronized (mRecords) {
             mCarrierServiceStates.set(
                     phoneId, new Pair<>(packageName, uid));
@@ -3364,7 +3380,8 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
     }
 
     private boolean validatePhoneId(int phoneId) {
-        boolean valid = (phoneId >= 0) && (phoneId < mNumPhones);
+        // Call getActiveModemCount to get the latest value instead of depending on mNumPhone
+        boolean valid = (phoneId >= 0) && (phoneId < getTelephonyManager().getActiveModemCount());
         if (VDBG) log("validatePhoneId: " + valid);
         return valid;
     }