From e93a6af4588fb39c1ef2b873c7f7dbae057b077f Mon Sep 17 00:00:00 2001
From: Joanne Chung <joannechung@google.com>
Date: Wed, 5 Jul 2023 11:16:19 +0000
Subject: [PATCH] Handle user removed for PackageMonitorCallbackHelper

Currently, when a user is removed from the system, the caller doesn't
call unregister method. Even though the registerd clients are mostly
use UserHandle.ALL now but we still need to handle it correctly to
avoid leakage.

Bug: 29385425
Test: manual. Create a user and remove user to make sure the method
works as expected.

Change-Id: Ibcdcdf29d552b5b0ea6ac877ce3956a900362870
---
 .../android/server/pm/PackageManagerService.java  |  1 +
 .../server/pm/PackageMonitorCallbackHelper.java   | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 477e120695e6b..5a81a1af50ec3 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -4299,6 +4299,7 @@ public class PackageManagerService implements PackageSender, TestUtilityService
             mAppsFilter.onUserDeleted(snapshotComputer(), userId);
         }
         mInstantAppRegistry.onUserRemoved(userId);
+        mPackageMonitorCallbackHelper.onUserRemoved(userId);
     }
 
     /**
diff --git a/services/core/java/com/android/server/pm/PackageMonitorCallbackHelper.java b/services/core/java/com/android/server/pm/PackageMonitorCallbackHelper.java
index 55823cfe41104..20d150845d015 100644
--- a/services/core/java/com/android/server/pm/PackageMonitorCallbackHelper.java
+++ b/services/core/java/com/android/server/pm/PackageMonitorCallbackHelper.java
@@ -68,6 +68,21 @@ class PackageMonitorCallbackHelper {
         }
     }
 
+    public void onUserRemoved(int userId) {
+        RemoteCallbackList<IRemoteCallback> callbacks;
+        synchronized (mLock) {
+            callbacks = mCallbacks;
+        }
+        int registerCount = callbacks.getRegisteredCallbackCount();
+        for (int i = 0; i < registerCount; i++) {
+            int registerUserId = (int) callbacks.getRegisteredCallbackCookie(i);
+            if (registerUserId == userId) {
+                IRemoteCallback callback = callbacks.getRegisteredCallbackItem(i);
+                unregisterPackageMonitorCallback(callback);
+            }
+        }
+    }
+
     public void notifyPackageAddedForNewUsers(String packageName,
             @AppIdInt int appId, @NonNull int[] userIds, @NonNull int[] instantUserIds,
             int dataLoaderType) {