Prevent mock location from leaking fudger offsets

By using a different location fudger for each provider, and by reseting
the fuger when mock location providers are removed we prevent mock
providers from being used to leak information on the current location
offsets.

Test: presubmits
Change-Id: Ib37c583631c84e01e19352b011ccf8a769f5102c

2 files changed, 15 insertions, 8 deletions

diff --git a/services/core/java/com/android/server/LocationManagerService.java b/services/core/java/com/android/server/LocationManagerService.java
index 207a6aa5b9d0..cfdb47bc3c6a 100644
--- a/services/core/java/com/android/server/LocationManagerService.java
+++ b/services/core/java/com/android/server/LocationManagerService.java
@@ -215,11 +215,6 @@ public class LocationManagerService extends ILocationManager.Stub {
     private PackageManager mPackageManager;
     private PowerManager mPowerManager;
 
-    // TODO: sharing a location fudger with mock providers can leak information as the mock provider
-    //   can be used to retrieve offset information. the fudger should likely be reset whenever mock
-    //   providers are added or removed
-    private LocationFudger mLocationFudger;
-
     private GeofenceManager mGeofenceManager;
     private GeocoderProxy mGeocodeProvider;
 
@@ -287,8 +282,6 @@ public class LocationManagerService extends ILocationManager.Stub {
             mPackageManager = mContext.getPackageManager();
             mAppOps = mContext.getSystemService(AppOpsManager.class);
             mPowerManager = mContext.getSystemService(PowerManager.class);
-
-            mLocationFudger = new LocationFudger(mSettingsHelper.getCoarseLocationAccuracyM());
             mGeofenceManager = new GeofenceManager(mContext, mSettingsHelper);
 
             PowerManagerInternal localPowerManager =
@@ -665,6 +658,8 @@ public class LocationManagerService extends ILocationManager.Stub {
 
         private final String mName;
 
+        private final LocationFudger mLocationFudger;
+
         // if the provider is enabled for a given user id - null or not present means unknown
         @GuardedBy("mLock")
         private final SparseArray<Boolean> mEnabled;
@@ -682,6 +677,7 @@ public class LocationManagerService extends ILocationManager.Stub {
 
         private LocationProviderManager(String name) {
             mName = name;
+            mLocationFudger = new LocationFudger(mSettingsHelper.getCoarseLocationAccuracyM());
             mEnabled = new SparseArray<>(2);
             mLastLocation = new SparseArray<>(2);
             mLastCoarseLocation = new SparseArray<>(2);
@@ -706,7 +702,9 @@ public class LocationManagerService extends ILocationManager.Stub {
             synchronized (mLock) {
                 mProvider.setMockProvider(provider);
 
-                // when removing a mock provider, also clear any mock last locations
+                // when removing a mock provider, also clear any mock last locations and reset the
+                // location fudger. the mock provider could have been used to infer the current
+                // location fudger offsets.
                 if (provider == null) {
                     for (int i = 0; i < mLastLocation.size(); i++) {
                         Location lastLocation = mLastLocation.valueAt(i);
@@ -721,6 +719,8 @@ public class LocationManagerService extends ILocationManager.Stub {
                             mLastCoarseLocation.setValueAt(i, null);
                         }
                     }
+
+                    mLocationFudger.resetOffsets();
                 }
             }
         }
diff --git a/services/core/java/com/android/server/location/LocationFudger.java b/services/core/java/com/android/server/location/LocationFudger.java
index a069e7ace636..1f458ed4e29d 100644
--- a/services/core/java/com/android/server/location/LocationFudger.java
+++ b/services/core/java/com/android/server/location/LocationFudger.java
@@ -87,6 +87,13 @@ public class LocationFudger {
         mRandom = random;
         mAccuracyM = Math.max(accuracyM, MIN_ACCURACY_M);
 
+        resetOffsets();
+    }
+
+    /**
+     * Resets the random offsets completely.
+     */
+    public void resetOffsets() {
         mLatitudeOffsetM = nextRandomOffset();
         mLongitudeOffsetM = nextRandomOffset();
         mNextUpdateRealtimeMs = mClock.millis() + OFFSET_UPDATE_INTERVAL_MS;