Merge "Fix race condition in AudioRecord::releaseBuffer()" am: cc0dec6cc2 am: dbf756b997 (ac2f85bf) · Commits · e / os / android_frameworks_av

media/libaudioclient/AudioRecord.cpp

+8 −2

Original line number	Diff line number	Diff line
		@@ -884,7 +884,6 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		{
		// previous and new IAudioRecord sequence numbers are used to detect track re-creation
		uint32_t oldSequence = 0;
		uint32_t newSequence;

		Proxy::Buffer buffer;
		status_t status = NO_ERROR;
		@@ -902,7 +901,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		// start of lock scope
		AutoMutex lock(mLock);

		newSequence = mSequence;
		uint32_t newSequence = mSequence;
		// did previous obtainBuffer() fail due to media server death or voluntary invalidation?
		if (status == DEAD_OBJECT) {
		// re-create track, unless someone else has already done so
		@@ -939,6 +938,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		audioBuffer->frameCount = buffer.mFrameCount;
		audioBuffer->size = buffer.mFrameCount * mFrameSize;
		audioBuffer->raw = buffer.mRaw;
		audioBuffer->sequence = oldSequence;
		if (nonContig != NULL) {
		*nonContig = buffer.mNonContig;
		}
		@@ -959,6 +959,12 @@ void AudioRecord::releaseBuffer(const Buffer* audioBuffer)
		buffer.mRaw = audioBuffer->raw;

		AutoMutex lock(mLock);
		if (audioBuffer->sequence != mSequence) {
		// This Buffer came from a different IAudioRecord instance, so ignore the releaseBuffer
		ALOGD("%s is no-op due to IAudioRecord sequence mismatch %u != %u",
		__func__, audioBuffer->sequence, mSequence);
		return;
		}
		mInOverrun = false;
		mProxy->releaseBuffer(&buffer);

+8 −0

Original line number	Diff line number	Diff line
		@@ -92,6 +92,11 @@ public:
		int8_t* i8; // unsigned 8-bit, offset by 0x80
		// input to obtainBuffer(): unused, output: pointer to buffer
		};

		uint32_t sequence; // IAudioRecord instance sequence number, as of obtainBuffer().
		// It is set by obtainBuffer() and confirmed by releaseBuffer().
		// Not "user-serviceable".
		// TODO Consider sp<IMemory> instead, or in addition to this.
		};

		/* As a convenience, if a callback is supplied, a handler thread
		@@ -420,14 +425,17 @@ public:
		* frameCount number of frames requested
		* size ignored
		* raw ignored
		* sequence ignored
		* After error return:
		* frameCount 0
		* size 0
		* raw undefined
		* sequence undefined
		* After successful return:
		* frameCount actual number of frames available, <= number requested
		* size actual number of bytes available
		* raw pointer to the buffer
		* sequence IAudioRecord instance sequence number, as of obtainBuffer()
		*/

		status_t obtainBuffer(Buffer* audioBuffer, int32_t waitCount,