diff options
author | Glenn Kasten <gkasten@google.com> | 2019-12-13 11:13:42 -0800 |
---|---|---|
committer | Glenn Kasten <gkasten@google.com> | 2020-03-24 15:50:30 -0700 |
commit | ab6d69d1feeaca072c2ee516e60e00a26c28350e (patch) | |
tree | 57d653f5c44e8b68d55d5bceec98a1f52aa199e8 | |
parent | 2d3c39c7ecfe6a34b013102496979a6f02649d4a (diff) | |
download | frameworks_av-ab6d69d1feeaca072c2ee516e60e00a26c28350e.tar.gz frameworks_av-ab6d69d1feeaca072c2ee516e60e00a26c28350e.tar.bz2 frameworks_av-ab6d69d1feeaca072c2ee516e60e00a26c28350e.zip |
Fix race condition in AudioRecord::releaseBuffer()
Ignore releaseBuffer() if it is for a different IAudioRecord than was
used for obtainBuffer().
Bug: 136268149
Test: at bug comments #26 and #27
Change-Id: I2a08c30bf9187b35535318761eaac7856da68c11
-rw-r--r-- | media/libaudioclient/AudioRecord.cpp | 10 | ||||
-rw-r--r-- | media/libaudioclient/include/media/AudioRecord.h | 8 |
2 files changed, 16 insertions, 2 deletions
diff --git a/media/libaudioclient/AudioRecord.cpp b/media/libaudioclient/AudioRecord.cpp index a1b04caa92..271e18655e 100644 --- a/media/libaudioclient/AudioRecord.cpp +++ b/media/libaudioclient/AudioRecord.cpp @@ -884,7 +884,6 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r { // previous and new IAudioRecord sequence numbers are used to detect track re-creation uint32_t oldSequence = 0; - uint32_t newSequence; Proxy::Buffer buffer; status_t status = NO_ERROR; @@ -902,7 +901,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r // start of lock scope AutoMutex lock(mLock); - newSequence = mSequence; + uint32_t newSequence = mSequence; // did previous obtainBuffer() fail due to media server death or voluntary invalidation? if (status == DEAD_OBJECT) { // re-create track, unless someone else has already done so @@ -939,6 +938,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r audioBuffer->frameCount = buffer.mFrameCount; audioBuffer->size = buffer.mFrameCount * mFrameSize; audioBuffer->raw = buffer.mRaw; + audioBuffer->sequence = oldSequence; if (nonContig != NULL) { *nonContig = buffer.mNonContig; } @@ -959,6 +959,12 @@ void AudioRecord::releaseBuffer(const Buffer* audioBuffer) buffer.mRaw = audioBuffer->raw; AutoMutex lock(mLock); + if (audioBuffer->sequence != mSequence) { + // This Buffer came from a different IAudioRecord instance, so ignore the releaseBuffer + ALOGD("%s is no-op due to IAudioRecord sequence mismatch %u != %u", + __func__, audioBuffer->sequence, mSequence); + return; + } mInOverrun = false; mProxy->releaseBuffer(&buffer); diff --git a/media/libaudioclient/include/media/AudioRecord.h b/media/libaudioclient/include/media/AudioRecord.h index a3c0fe4ac5..574302b869 100644 --- a/media/libaudioclient/include/media/AudioRecord.h +++ b/media/libaudioclient/include/media/AudioRecord.h @@ -92,6 +92,11 @@ public: int8_t* i8; // unsigned 8-bit, offset by 0x80 // input to obtainBuffer(): unused, output: pointer to buffer }; + + uint32_t sequence; // IAudioRecord instance sequence number, as of obtainBuffer(). + // It is set by obtainBuffer() and confirmed by releaseBuffer(). + // Not "user-serviceable". + // TODO Consider sp<IMemory> instead, or in addition to this. }; /* As a convenience, if a callback is supplied, a handler thread @@ -420,14 +425,17 @@ public: * frameCount number of frames requested * size ignored * raw ignored + * sequence ignored * After error return: * frameCount 0 * size 0 * raw undefined + * sequence undefined * After successful return: * frameCount actual number of frames available, <= number requested * size actual number of bytes available * raw pointer to the buffer + * sequence IAudioRecord instance sequence number, as of obtainBuffer() */ status_t obtainBuffer(Buffer* audioBuffer, int32_t waitCount, |