Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7507fef authored by Chaithanya Krishna Bacharaju's avatar Chaithanya Krishna Bacharaju Committed by Steve Kondik
Browse files

audioflinger: Fix for race conditions in direct audio track 

-Issue: Mediaserver crash is observed in direct track functions.
-Rootcause: Between write and flush functions, write and destructor
effectpool buffers are accessed without any synchronization that
might lead to operations on null buffers and cause crash.
-Fix: Use mEffectLock to synchronize access of effectpool buffers.

CRs-Fixed: 515107
cherrypicked from Ib071361c65b390f9486c0a080a9391f176392b30

Change-Id: Id9e14a054d699ec803e23619ef475696b0021d4f
parent c2e65a4c

services/audioflinger/Threads.cpp

+8 −3
Original line number Diff line number Diff line
@@ -4686,8 +4686,8 @@ ssize_t AudioFlinger::DirectAudioTrack::write(const void *buffer, size_t size) { 
        return 0;

    }



    if (mFlag & AUDIO_OUTPUT_FLAG_LPA) {

    mEffectLock.lock();

    if (mFlag & AUDIO_OUTPUT_FLAG_LPA && !mEffectsPool.empty()) {

        List<BufferInfo>::iterator it = mEffectsPool.begin();

        BufferInfo buf = *it;

        mEffectsPool.erase(it);
@@ -4696,16 +4696,18 @@ ssize_t AudioFlinger::DirectAudioTrack::write(const void *buffer, size_t size) { 
        mEffectsPool.push_back(buf);

        mAudioFlinger->applyEffectsOn(static_cast<void *>(this),

            (int16_t*)buf.localBuf, (int16_t*)buffer, (int)size, true);

        mEffectLock.unlock();

    }

    mEffectLock.unlock();

    ALOGV("out of Writing to AudioSessionOut");

    return mOutputDesc->stream->write(mOutputDesc->stream, buffer, size);

}



void AudioFlinger::DirectAudioTrack::flush() {

    if (mFlag & AUDIO_OUTPUT_FLAG_LPA) {

        mEffectLock.lock();

        mEffectsPool.clear();

        mEffectsPool = mBufPool;

        mEffectLock.unlock();

    }

    mOutputDesc->stream->flush(mOutputDesc->stream);

}
@@ -4786,6 +4788,7 @@ void AudioFlinger::DirectAudioTrack::deallocateBufPool() { 


    //1. Deallocate the local memory

    //2. Remove all the buffers from bufpool

    mEffectLock.lock();

    while (!mBufPool.empty())  {

        List<BufferInfo>::iterator it = mBufPool.begin();

        BufferInfo &memBuffer = *it;
@@ -4797,6 +4800,8 @@ void AudioFlinger::DirectAudioTrack::deallocateBufPool() { 
        ALOGV("Removing from bufpool");

        mBufPool.erase(it);

    }

    mEffectsPool.clear();

    mEffectLock.unlock();



    free(mEffectsThreadScratchBuffer);

    mEffectsThreadScratchBuffer = NULL;