From b3ba162ce0618c1ff0405a24b5a46261d8a1900e Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Thu, 11 Apr 2019 13:40:51 -0700
Subject: [PATCH] Cleans up userId loop in clearPackageStateForUser

This change fixes incorrect user ID references while clearing package
state in the case that it is being called with USER_ALL. Thankfully
this scenario can only take place when a non-system child package is
uninstalled for all users.

Fixes: 120814622
Test: atest AppSecurityTests
Change-Id: I462c383ad68efcde88eaacdb62dfcd6490f343e0
---
 .../com/android/server/pm/PackageManagerService.java | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 6c5abe49fe137..3d3c50e151dc6 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -10021,7 +10021,7 @@ public class PackageManagerService extends IPackageManager.Stub
         }
     }
 
-    private void destroyAppProfilesLIF(PackageParser.Package pkg, int userId) {
+    private void destroyAppProfilesLIF(PackageParser.Package pkg) {
         if (pkg == null) {
             Slog.wtf(TAG, "Package was null!", new Throwable());
             return;
@@ -18370,7 +18370,7 @@ public class PackageManagerService extends IPackageManager.Stub
             }
             destroyAppDataLIF(resolvedPkg, UserHandle.USER_ALL,
                     StorageManager.FLAG_STORAGE_DE | StorageManager.FLAG_STORAGE_CE);
-            destroyAppProfilesLIF(resolvedPkg, UserHandle.USER_ALL);
+            destroyAppProfilesLIF(resolvedPkg);
             if (outInfo != null) {
                 outInfo.dataRemoved = true;
             }
@@ -19090,6 +19090,8 @@ public class PackageManagerService extends IPackageManager.Stub
             pkg = mPackages.get(ps.name);
         }
 
+        destroyAppProfilesLIF(pkg);
+
         final int[] userIds = (userId == UserHandle.USER_ALL) ? sUserManager.getUserIds()
                 : new int[] {userId};
         for (int nextUserId : userIds) {
@@ -19098,11 +19100,9 @@ public class PackageManagerService extends IPackageManager.Stub
                         + nextUserId);
             }
 
-            destroyAppDataLIF(pkg, userId,
+            destroyAppDataLIF(pkg, nextUserId,
                     StorageManager.FLAG_STORAGE_DE | StorageManager.FLAG_STORAGE_CE);
-            destroyAppProfilesLIF(pkg, userId);
-            clearDefaultBrowserIfNeededForUser(ps.name, userId);
-            removeKeystoreDataIfNeeded(nextUserId, ps.appId);
+            clearDefaultBrowserIfNeededForUser(ps.name, nextUserId);
             synchronized (mPackages) {
                 if (clearPackagePreferredActivitiesLPw(ps.name, nextUserId)) {
                     scheduleWritePackageRestrictionsLocked(nextUserId);