From b09de4738d27cf445afbd67cbddc87db6f61f509 Mon Sep 17 00:00:00 2001
From: Andrea Ambu <andreaambu@google.com>
Date: Fri, 9 Jul 2021 14:43:35 +0100
Subject: [PATCH] speech: Fix RemoteSpeechReco race condition

stopListening schedules a Runnable referring to mDelegatingListener.
mDelegatingListener can be set to null before the Runnable runs, causing
NullPointerException when it does run.

This CL defines a local alias for the current mDelegatingListener reference,
and uses this new alias in the Runnable closure.

After this CL, even if mDelegatingListener changes between stopListening
and run(), run() will always use the DelegatingListener
mDelegatingListener was pointing to at schedule-time rather than
run-time.

Bug: 193046622
Test: atest CtsVoiceRecognitionTestCases
Change-Id: I98b4fabf074873ce17e4046e243fe22f9e541f91
(cherry picked from commit a3312942cd826d627057a97df37a49da61c63458)
---
 .../server/speech/RemoteSpeechRecognitionService.java     | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java b/services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java
index 9c8ff685d14de..068626588745f 100644
--- a/services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java
+++ b/services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java
@@ -125,10 +125,12 @@ final class RemoteSpeechRecognitionService extends ServiceConnector.Impl<IRecogn
                 }
             });
 
+            // Eager local evaluation to avoid reading a different or null value at closure-run-time
+            final DelegatingListener listenerToStart = this.mDelegatingListener;
             run(service ->
                     service.startListening(
                             recognizerIntent,
-                            mDelegatingListener,
+                            listenerToStart,
                             attributionSource));
         }
     }
@@ -162,7 +164,9 @@ final class RemoteSpeechRecognitionService extends ServiceConnector.Impl<IRecogn
             }
             mRecordingInProgress = false;
 
-            run(service -> service.stopListening(mDelegatingListener));
+            // Eager local evaluation to avoid reading a different or null value at closure-run-time
+            final DelegatingListener listenerToStop = this.mDelegatingListener;
+            run(service -> service.stopListening(listenerToStop));
         }
     }