diff options
| author | Eric Laurent <elaurent@google.com> | 2015-12-03 18:52:10 -0800 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-02-26 16:56:15 -0800 |
| commit | a18111d2db2a5e43a5ba318073986c12f9c86720 (patch) | |
| tree | 166ec45e042560665ca67037c7a020b35e3bdf65 | |
| parent | 26f06c79dd04fba38a97f2548ead140d25edde78 (diff) | |
| download | hardware_qcom_audio-a18111d2db2a5e43a5ba318073986c12f9c86720.tar.gz hardware_qcom_audio-a18111d2db2a5e43a5ba318073986c12f9c86720.tar.bz2 hardware_qcom_audio-a18111d2db2a5e43a5ba318073986c12f9c86720.zip | |
post proc : volume listener : fix effect release crash
Fix access to deleted effect context in vol_prc_lib_release()
Bug: 25753245.
Change-Id: I64ca99e4d5d09667be4c8c605f66700b9ae67949
(cherry picked from commit 93ab6fdda7b7557ccb34372670c30fa6178f8426)
| -rw-r--r-- | post_proc/volume_listener.c | 23 |
1 files changed, 18 insertions, 5 deletions
diff --git a/post_proc/volume_listener.c b/post_proc/volume_listener.c index 34954bbc..ef632993 100644 --- a/post_proc/volume_listener.c +++ b/post_proc/volume_listener.c @@ -688,20 +688,31 @@ static int vol_prc_lib_release(effect_handle_t handle) struct listnode *node, *temp_node_next; vol_listener_context_t *context = NULL; vol_listener_context_t *recv_contex = (vol_listener_context_t *)handle; - int status = -1; + int status = -EINVAL; bool recompute_flag = false; int active_stream_count = 0; + uint32_t session_id; + uint32_t stream_type; + effect_uuid_t uuid; + ALOGV("%s context %p", __func__, handle); + + if (recv_contex == NULL) { + return status; + } pthread_mutex_lock(&vol_listner_init_lock); + session_id = recv_contex->session_id; + stream_type = recv_contex->stream_type; + uuid = recv_contex->desc->uuid; // check if the handle/context provided is valid list_for_each_safe(node, temp_node_next, &vol_effect_list) { context = node_to_item(node, struct vol_listener_context_s, effect_list_node); - if ((memcmp(&(context->desc->uuid), &(recv_contex->desc->uuid), sizeof(effect_uuid_t)) == 0) - && (context->session_id == recv_contex->session_id) - && (context->stream_type == recv_contex->stream_type)) { + if ((memcmp(&(context->desc->uuid), &uuid, sizeof(effect_uuid_t)) == 0) + && (context->session_id == session_id) + && (context->stream_type == stream_type)) { ALOGV("--- Found something to remove ---"); - list_remove(&context->effect_list_node); + list_remove(node); PRINT_STREAM_TYPE(context->stream_type); if (context->dev_id == AUDIO_DEVICE_OUT_SPEAKER) { recompute_flag = true; @@ -715,6 +726,8 @@ static int vol_prc_lib_release(effect_handle_t handle) if (status != 0) { ALOGE("something wrong ... <<<--- Found NOTHING to remove ... ???? --->>>>>"); + pthread_mutex_unlock(&vol_listner_init_lock); + return status; } // if there are no active streams, reset cal and volume level |