Skip to content
Commit 520dc3bd authored by Ryan Hansberry's avatar Ryan Hansberry Committed by Chromium LUCI CQ
Browse files

[SmartLock] Delay AuthAttempt destruction until screen unlocks.

Prior to this CL, the AuthAttempt managed by EasyUnlockService only
remained alive from the point the user began Smart Lock auth flow (user
profile photo is tapped) until EasyUnlockService received confirmation
from the phone that unlock is allowed. If the user double-clicked that
user profile photo, the second click would very likely occur after the
phone approved the unlock request, which meant EasyUnlockService kicked
off a whole new AuthAttempt while the screen was unlocking and Smart
Lock was actually in the middle of tearing itself down. In particular,
MessengerImpl was torn down and encountered a UAF.

I suspect this crash was quite easy to encounter on the sign-in screen
because it takes several seconds for the cryptohome to decrypt -- it's
very likely that users could tap the user profile picture multiple
times because it feels as if the sign-in screen is stuck.

This CL only tears down the AuthAttempt in a successful flow once the
screen unlocks (see UpdateScreenlockState()). This allows the check
in EasyUnlockService::AttemptAuth() to actually prevent multiple auth
attempt requests.

Fixed: 974410, 1041446
Change-Id: Ia65fbd546a543523d9393c459ec602bcce2ed81f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2774284


Reviewed-by: default avatarJames Vecore <vecore@google.com>
Commit-Queue: Ryan Hansberry <hansberry@chromium.org>
Cr-Commit-Position: refs/heads/master@{#864688}
parent 204d0482
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment