commit 038fd80ce8b34d30bbd4ae8084f085b38ab34ca0
author Maciej Żenczykowski <maze@google.com> Sat Feb 19 22:45:42 2022 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Sat Feb 19 22:45:42 2022 +0000
tree a3a6c1f2991d11cecef13900d2371a4852b77abc
parent e60fa2d09935453fd647616362d80438dfe3116e
parent 5f3045cae792fd2fa67a931fe1cc03245eaecc2e

Merge "Fix system_server crash while iterating CookieTagMap" am: dd5a31eb2d am: c1124eff5b am: 5f3045cae7

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1990333

Change-Id: Ic459069134734d7bf80b45bb6acd2a9fded4afbb

packages/ConnectivityT/service/src/com/android/server/net/NetworkStatsService.java

diff --git a/packages/ConnectivityT/service/src/com/android/server/net/NetworkStatsService.java b/packages/ConnectivityT/service/src/com/android/server/net/NetworkStatsService.java
index ef9ebb5..ef6f39a 100644
--- a/packages/ConnectivityT/service/src/com/android/server/net/NetworkStatsService.java
+++ b/packages/ConnectivityT/service/src/com/android/server/net/NetworkStatsService.java
@@ -1887,7 +1887,13 @@
     private void deleteKernelTagData(int uid) {
         try {
             mCookieTagMap.forEach((key, value) -> {
-                if (value.uid == uid) {
+                // If SkDestroyListener deletes the socket tag while this code is running,
+                // forEach will either restart iteration from the beginning or return null,
+                // depending on when the deletion happens.
+                // If it returns null, continue iteration to delete the data and in fact it would
+                // just iterate from first key because BpfMap#getNextKey would return first key
+                // if the current key is not exist.
+                if (value != null && value.uid == uid) {
                     try {
                         mCookieTagMap.deleteEntry(key);
                     } catch (ErrnoException e) {