ClassCastException problem in getUnfilteredActiveNetworkState

Crash logs.

12-19 03:52:30.914   641  3002 D ConnectivityService: notifyType LOST for NetworkAgentInfo [WIFI () - 108]
12-19 03:52:30.915   641  3002 D CSLegacyTypeTracker: Sending disconnected broadcast for type 1 NetworkAgentInfo [WIFI () - 108] isDefaultNetwork=true
12-19 03:52:30.915   641  3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE_IMMEDIATE
12-19 03:52:30.915   641  3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE
12-19 03:52:30.917   641  3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE_IMMEDIATE
12-19 03:52:30.917   641  3002 D ConnectivityService: sendStickyBroadcast: action=android.net.conn.CONNECTIVITY_CHANGE
12-19 03:52:30.918   641  3002 D ConnectivityService: Checking for replacement network to handle request NetworkRequest [ id=1, legacyType=-1, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VPN] ]
12-19 03:52:30.918   641  3002 E ConnectivityService: handleAsyncChannelDisconnected() mActiveDefaultNetwork= TYPE_NONE
12-19 03:52:30.921   641  3002 E ConnectivityService: EVENT_NETWORK_INFO_CHANGED from unknown NetworkAgent
12-19 03:52:30.923   641   641 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
12-19 03:52:30.923   641   641 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.net.conn.CONNECTIVITY_CHANGE flg=0x4000010 (has extras) } in com.android.server.content.SyncManager$4@139df0cb
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:912)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.os.Handler.handleCallback(Handler.java:739)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.os.Handler.dispatchMessage(Handler.java:95)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.os.Looper.loop(Looper.java:135)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.SystemServer.run(SystemServer.java:290)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.SystemServer.main(SystemServer.java:190)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at java.lang.reflect.Method.invoke(Native Method)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at java.lang.reflect.Method.invoke(Method.java:372)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:984)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
12-19 03:52:30.923   641   641 E AndroidRuntime: Caused by: java.lang.ClassCastException: java.lang.Object cannot be cast to com.android.server.connectivity.NetworkAgentInfo
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.ConnectivityService.getUnfilteredActiveNetworkState(ConnectivityService.java:931)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.ConnectivityService.getActiveNetworkInfo(ConnectivityService.java:1014)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.net.ConnectivityManager.getActiveNetworkInfo(ConnectivityManager.java:616)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager.readDataConnectionState(SyncManager.java:343)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager.access$400(SyncManager.java:123)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager$4.onReceive(SyncManager.java:327)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:902)
12-19 03:52:30.923   641   641 E AndroidRuntime:     ... 9 more
12-19 03:52:30.923   641   641 I AndroidRuntime: To Report FATAL to activityManagerService
12-19 03:52:30.948   641  3198 D WifiService: releaseWifiLockLocked: WifiLock{AndroidRouter type=3 binder=android.os.BinderProxy@3b2bdcb5}
12-19 03:52:30.950   641   641 I ActivityManager: addErrorToDropBox inserted hashcode=44497a8b9c09a26d1cfd89e2a1b25d114ac35ddb for eventType crash.

Analysis.

From the logs, we can see that the problem happened when system  tried to get network info by callinggetActiveNetworkInfo method.

And before this, system is calling handleAsyncChannelDisconnected method to process channel disconnected message.

These two operations are executed in two different thread.

1. getActiveNetworkInfo method is called in mConnectivityIntentReceiver.onReceive.The method is executed insystem server's main thread. It is used to handle"com.amazon.speech.CONNECTIVITY_ACTION" broadcast.

In getActiveNetworkInfo method, it is going to get network info.

924    private NetworkState getUnfilteredActiveNetworkState(int uid) {925        NetworkInfo info = null;926        LinkProperties lp = null;927        NetworkCapabilities nc = null;928        Network network = null;929        String subscriberId = null;930931        NetworkAgentInfo nai = mNetworkForRequestId.get(mDefaultRequest.requestId);

12-19 03:52:30.923   641   641 E AndroidRuntime: Caused by: java.lang.ClassCastException: java.lang.Object cannot be cast to com.android.server.connectivity.NetworkAgentInfo
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.ConnectivityService.getUnfilteredActiveNetworkState(ConnectivityService.java:931)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.ConnectivityService.getActiveNetworkInfo(ConnectivityService.java:1014)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.net.ConnectivityManager.getActiveNetworkInfo(ConnectivityManager.java:616)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager.readDataConnectionState(SyncManager.java:343)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager.access$400(SyncManager.java:123)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at com.android.server.content.SyncManager$4.onReceive(SyncManager.java:327)
12-19 03:52:30.923   641   641 E AndroidRuntime:     at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:902)

2. handleAsyncChannelDisconnected is called inConnectivityServiceThread.

2019        public void handleMessage(Message msg) {2020            NetworkInfo info;2021            switch (msg.what) {2031                case AsyncChannel.CMD_CHANNEL_DISCONNECTED: {2032                    handleAsyncChannelDisconnected(msg);2033                    break;2034                }

In handleAsyncChannelDisconnected, it is going to remove network info from mNetworkForRequestId array.

2295    private void handleAsyncChannelDisconnected(Message msg) {2296        NetworkAgentInfo nai = mNetworkAgentInfos.get(msg.replyTo);2297        if (nai != null) {2335            for (int i = 0; i < nai.networkRequests.size(); i++) {2336                NetworkRequest request = nai.networkRequests.valueAt(i);2337                NetworkAgentInfo currentNetwork = mNetworkForRequestId.get(request.requestId);2338                if (currentNetwork != null && currentNetwork.network.netId == nai.network.netId) {2342                    mNetworkForRequestId.remove(request.requestId);2359            }2371        }2372    }

As these 2 operations are executed in 2 different thread, and not protected by lock, it may run into some race condition. If the remove operation is executed before get operation, the get operation will return null.

ClassCastException will be thrown if we try to convertnull object to NetworkAgentInfo object as below.

931        NetworkAgentInfo nai = mNetworkForRequestId.get(mDefaultRequest.requestId);