Call isUserUnlockingOrUnlocked with cleared identity

Bug: 28709934
Change-Id: I61fc31e906c8498f19d6d76cd0dc5f2de9738708

diff --git a/services/core/java/com/android/server/am/ActivityStarter.java b/services/core/java/com/android/server/am/ActivityStarter.java
index c15effb..64bd14c 100644 (file)
--- a/services/core/java/com/android/server/am/ActivityStarter.java
+++ b/services/core/java/com/android/server/am/ActivityStarter.java
@@ -677,16 +677,17 @@ class ActivityStarter {
                 // app in a locked managed profile from an unlocked parent allow it to resolve
                 // as user will be sent via confirm credentials to unlock the profile.
                 UserManager userManager = UserManager.get(mService.mContext);
-                UserInfo parent = null;
+                boolean profileLockedAndParentUnlockingOrUnlocked = false;
                 long token = Binder.clearCallingIdentity();
                 try {
-                    parent = userManager.getProfileParent(userId);
+                    UserInfo parent = userManager.getProfileParent(userId);
+                    profileLockedAndParentUnlockingOrUnlocked = (parent != null)
+                            && userManager.isUserUnlockingOrUnlocked(parent.id)
+                            && !userManager.isUserUnlockingOrUnlocked(userId);
                 } finally {
                     Binder.restoreCallingIdentity(token);
                 }
-                if (parent != null
-                        && userManager.isUserUnlockingOrUnlocked(parent.getUserHandle())
-                        && !userManager.isUserUnlockingOrUnlocked(userInfo.getUserHandle())) {
+                if (profileLockedAndParentUnlockingOrUnlocked) {
                     rInfo = mSupervisor.resolveIntent(intent, resolvedType, userId,
                             PackageManager.MATCH_DIRECT_BOOT_AWARE
                                     | PackageManager.MATCH_DIRECT_BOOT_UNAWARE);