From 166e569b7a75929346a4dc8891a66e36b8e94bf3 Mon Sep 17 00:00:00 2001
From: zhuning3 <zhuning3@xiaomi.com>
Date: Wed, 19 Jul 2023 14:12:21 +0800
Subject: [PATCH] Fix the concurrency issue when 'linkToDeath' in
 AccountManagerService that leads to JE

Move the ref of 'mResponse' after the completion of 'linkToDeath' to avoid concurrency issues caused by 'unlinkToDeath' being triggered in different thread

Test: MTBF
Bug: 291856266

Change-Id: Ifc5af9f85aac83be56afec9a1fb32501a6f32ebc
Signed-off-by: zhuning3 <zhuning3@xiaomi.corp-partner.google.com>
---
 .../com/android/server/accounts/AccountManagerService.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index 2a9dc52aee11e..f1bcb2bc32db4 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -4854,7 +4854,6 @@ public class AccountManagerService
             if (accountType == null) throw new IllegalArgumentException("accountType is null");
             mAccounts = accounts;
             mStripAuthTokenFromResult = stripAuthTokenFromResult;
-            mResponse = response;
             mAccountType = accountType;
             mExpectActivityLaunch = expectActivityLaunch;
             mCreationTime = SystemClock.elapsedRealtime();
@@ -4868,8 +4867,8 @@ public class AccountManagerService
             if (response != null) {
                 try {
                     response.asBinder().linkToDeath(this, 0 /* flags */);
+                    mResponse = response;
                 } catch (RemoteException e) {
-                    mResponse = null;
                     binderDied();
                 }
             }