[Bug] Hook on SystemServiceManager#loadClassFromLoader throws, preventing LocationPolicyManagerService from starting (v0.1.3)

[godadom]

Summary

The hook on SystemServiceManager#loadClassFromLoader lets an exception escape,
which prevents com.android.server.location.LocationPolicyManagerService from
starting. This happens on every boot, reproducibly, and the module's own code
is in the stack.

Environment

Device	Redmi K90 Pro Max (25102RKBEC, codename myron)
Build	Redmi/myron/myron:16/BP2A.250605.031.A3/OS3.0.306.0.WPMCNXM:user/release-keys
Android	16 (SDK 36), HyperOS 3
XposedFakeLocation	v0.1.3 (versionCode 103)
Root	KernelSU ksud 4.1.3
Xposed	LSPosed v2.1.1 (7790), ZygiskNext 1.4.3
Module scope	System Framework + several apps

Stack trace

W SystemServerI: Failed to start com.android.server.location.LocationPolicyManagerService$Lifecycle
W SystemServerI: java.lang.RuntimeException: Failed to create service
                 com.android.server.location.LocationPolicyManagerService$Lifecycle from class loader ...
	at com.android.server.SystemServiceManager.loadClassFromLoader(SystemServiceManager.java:214)
	at java.lang.reflect.Method.invoke(Native Method)
	at org.lsposed.lspd.core.nativebridge.HookBridge.invokeOriginalMethod(Native Method)
	at k.proceed(...)
	at f2.proceed(...)
	at com.noobexon.xposedfakelocation.xposed.hooks.SystemServicesHooks.hookWifiServices$lambda$15(SystemServicesHooks.kt:256)
	at com.noobexon.xposedfakelocation.xposed.hooks.SystemServicesHooks.$r8$lambda$uLkjip514Q_dIEWNkZr4aT6xhI0(Unknown Source:0)
	at com.noobexon.xposedfakelocation.xposed.hooks.SystemServicesHooks$$ExternalSyntheticLambda1.intercept(D8$$SyntheticClass:0)
	at g2.intercept(...)
	at k.proceed(...)
	at o0.callback(...)
	at android.util.NeatnClurkookHar.loadClassFromLoader(NeatnClurkookHar.java)
	at com.android.server.SystemServiceManager.startService(SystemServiceManager.java:153)
	at com.android.server.SystemServerImpl.startService(SystemServerImpl.java:195)
	at com.android.server.SystemServerImpl.addExtraServices(SystemServerImpl.java:230)
	at com.android.server.SystemServer.startOtherServices(SystemServer.java:2839)

Analysis

hookWifiServices$lambda$15 installs an interceptor on
SystemServiceManager#loadClassFromLoader. That method is called by the platform
for every system service it loads, not just the Wi-Fi ones the hook cares
about. When LocationPolicyManagerService$Lifecycle is passed through it, the
call fails and the resulting RuntimeException propagates out of the
interceptor, so the platform's startService treats the service as unstartable
and skips it.

Since loadClassFromLoader is a very hot, very general entry point, an
interceptor there needs to be defensive about every class it does not recognise.

Steps to reproduce

1. Install XposedFakeLocation v0.1.3, enable it in LSPosed with System Framework in scope.
2. Reboot.
3. adb logcat -b system | grep "Failed to start com.android.server.location"

Reproduces on every boot here. Un-scoping the module from System Framework makes
it go away.

Suggested fix

Wrap the interceptor body so that any class the hook does not explicitly intend
to handle falls straight through to proceed() without the interceptor being
able to throw — roughly:

// in hookWifiServices, around the loadClassFromLoader interceptor
try {
    // existing logic, only for the classes actually targeted
} catch (t: Throwable) {
    // never let a hook failure break platform service startup
}
return proceed()

Narrowing the hook to only the specific service class names it needs, rather
than intercepting all of loadClassFromLoader, would be even better.

Note

I also hit a system_server soft reboot on this device with a stack identical to
#26. That is filed separately, since it is a different failure and I have not
proven the module caused it. Mentioning it here only because both involve the
module's hooks in the location subsystem, and a shared root cause is not
impossible.

Related boot-time warnings

Possibly unrelated, but logged by the module at the same boot and suggesting some
hook targets have drifted on Android 16:

No method named addGnssBatchingCallback on com.android.server.location.gnss.GnssManagerService
No method named addGnssBatchingCallback on com.android.server.location.LocationManagerService
None of these classes were found: com.android.server.location.LocationManagerService$...

Happy to provide full logcat or LSPosed verbose/module logs on request.

[godadom]

For cross-reference: the separately-filed soft reboot is #50.