From 00bf6da8468fdc2b97f626dbad024f78795c5d4b Mon Sep 17 00:00:00 2001
From: Jing Ji <jji@google.com>
Date: Wed, 24 May 2023 22:05:51 -0700
Subject: [PATCH] Fix the processgroup creation failure due to race conditions

...between creating the process and attaching the process.

The webview/app zygote process creation consists two steps:
a) Fork the process; b) Create the processgroup.
Betwen a) and b), if the app process has started and attaches
itself to the system_server, and also dies before b), we'd
end up killing its processgroup before creating it. This CL
fixed this issue.

Bug: 283391058
Test: Manual
Change-Id: I2c68f43ac921621bf0a3b0b2b399118518c60ca1
---
 .../server/am/ActivityManagerService.java     |  2 +-
 .../com/android/server/am/ProcessRecord.java  | 45 ++++++++++---------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 544828afed647..a4705d0fd3077 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -3393,7 +3393,7 @@ public class ActivityManagerService extends IActivityManager.Stub
                 mProcessList.noteAppKill(app, ApplicationExitInfo.REASON_OTHER,
                         ApplicationExitInfo.SUBREASON_UNKNOWN, reason);
             }
-            ProcessList.killProcessGroup(app.uid, pid);
+            app.killProcessGroupIfNecessaryLocked(true);
             synchronized (mProcLock) {
                 app.setKilled(true);
             }
diff --git a/services/core/java/com/android/server/am/ProcessRecord.java b/services/core/java/com/android/server/am/ProcessRecord.java
index 335d6768c37be..d6495c78574ca 100644
--- a/services/core/java/com/android/server/am/ProcessRecord.java
+++ b/services/core/java/com/android/server/am/ProcessRecord.java
@@ -1197,26 +1197,7 @@ class ProcessRecord implements WindowProcessListener {
                 EventLog.writeEvent(EventLogTags.AM_KILL,
                         userId, mPid, processName, mState.getSetAdj(), reason);
                 Process.killProcessQuiet(mPid);
-                final boolean killProcessGroup;
-                if (mHostingRecord != null
-                        && (mHostingRecord.usesWebviewZygote() || mHostingRecord.usesAppZygote())) {
-                    synchronized (ProcessRecord.this) {
-                        killProcessGroup = mProcessGroupCreated;
-                        if (!killProcessGroup) {
-                            // The process group hasn't been created, request to skip it.
-                            mSkipProcessGroupCreation = true;
-                        }
-                    }
-                } else {
-                    killProcessGroup = true;
-                }
-                if (killProcessGroup) {
-                    if (asyncKPG) {
-                        ProcessList.killProcessGroup(uid, mPid);
-                    } else {
-                        Process.sendSignalToProcessGroup(uid, mPid, OsConstants.SIGKILL);
-                    }
-                }
+                killProcessGroupIfNecessaryLocked(asyncKPG);
             } else {
                 mPendingStart = false;
             }
@@ -1231,6 +1212,30 @@ class ProcessRecord implements WindowProcessListener {
         }
     }
 
+    @GuardedBy("mService")
+    void killProcessGroupIfNecessaryLocked(boolean async) {
+        final boolean killProcessGroup;
+        if (mHostingRecord != null
+                && (mHostingRecord.usesWebviewZygote() || mHostingRecord.usesAppZygote())) {
+            synchronized (ProcessRecord.this) {
+                killProcessGroup = mProcessGroupCreated;
+                if (!killProcessGroup) {
+                    // The process group hasn't been created, request to skip it.
+                    mSkipProcessGroupCreation = true;
+                }
+            }
+        } else {
+            killProcessGroup = true;
+        }
+        if (killProcessGroup) {
+            if (async) {
+                ProcessList.killProcessGroup(uid, mPid);
+            } else {
+                Process.sendSignalToProcessGroup(uid, mPid, OsConstants.SIGKILL);
+            }
+        }
+    }
+
     @Override
     public void dumpDebug(ProtoOutputStream proto, long fieldId) {
         dumpDebug(proto, fieldId, -1);