Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f2aa2505 authored by Shraddha Basantwani's avatar Shraddha Basantwani
Browse files

AudioSystem : Add method to disable creation of thread pool 

Test: ./audioflinger_aidl_fuzzer
Test: ./audiopolicy_aidl_fuzzer
Bug: 330882064
Change-Id: Ie7a97f02e0e9f3e009f0c530c8a2d3261a94e0df
parent 49193a1c

media/libaudioclient/AudioSystem.cpp

+12 −6
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ template <typename ServiceInterface, typename Client, typename AidlInterface, 
        typename ServiceTraits>

class ServiceHandler {

public:

    sp<ServiceInterface> getService(bool canStartThreadPool = true)

    sp<ServiceInterface> getService()

            EXCLUDES(mMutex) NO_THREAD_SAFETY_ANALYSIS {  // std::unique_ptr

        sp<ServiceInterface> service;

        sp<Client> client;
@@ -140,7 +140,7 @@ public: 
        client = mClient;

        service = mService;

        // Make sure callbacks can be received by the client

        if (canStartThreadPool) {

        if (mCanStartThreadPool) {

            ProcessState::self()->startThreadPool();

        }

        ul.unlock();
@@ -183,6 +183,10 @@ public: 
        if (mClient) ServiceTraits::onClearService(mClient);

    }



    void disableThreadPool() {

        mCanStartThreadPool = false;

    }



private:

    std::mutex mSingleGetter;

    std::mutex mMutex;
@@ -191,6 +195,7 @@ private: 
    sp<ServiceInterface> mLocalService GUARDED_BY(mMutex);

    sp<ServiceInterface> mService GUARDED_BY(mMutex);

    sp<Client> mClient GUARDED_BY(mMutex);

    std::atomic<bool> mCanStartThreadPool = true;

};



struct AudioFlingerTraits {
@@ -221,10 +226,6 @@ sp<IAudioFlinger> AudioSystem::get_audio_flinger() { 
    return gAudioFlingerServiceHandler.getService();

}



sp<IAudioFlinger> AudioSystem::get_audio_flinger_for_fuzzer() {

    return gAudioFlingerServiceHandler.getService(false /* canStartThreadPool */);

}



sp<AudioSystem::AudioFlingerClient> AudioSystem::getAudioFlingerClient() {

    return gAudioFlingerServiceHandler.getClient();

}
@@ -954,6 +955,11 @@ void AudioSystem::clearAudioPolicyService() { 
    gAudioPolicyServiceHandler.clearService();

}



void AudioSystem::disableThreadPool() {

    gAudioFlingerServiceHandler.disableThreadPool();

    gAudioPolicyServiceHandler.disableThreadPool();

}



// ---------------------------------------------------------------------------



void AudioSystem::onNewAudioModulesAvailable() {

media/libaudioclient/aidl/fuzzer/audioflinger_aidl_fuzzer.cpp

+3 −1
Original line number Diff line number Diff line
@@ -77,6 +77,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 
    CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),

                                                  "android.hardware.audio.core.IModule/default"));



    // Disable creating thread pool for fuzzer instance of audio flinger and audio policy services

    AudioSystem::disableThreadPool();



    const auto audioFlinger = sp<AudioFlinger>::make();

    const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);
@@ -85,7 +88,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 
                     String16(IAudioFlinger::DEFAULT_SERVICE_NAME), IInterface::asBinder(afAdapter),

                     false /* allowIsolated */, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));



    AudioSystem::get_audio_flinger_for_fuzzer();

    const auto audioPolicyService = sp<AudioPolicyService>::make();



    CHECK_EQ(NO_ERROR,

media/libaudioclient/include/media/AudioSystem.h

+4 −1
Original line number Diff line number Diff line
@@ -187,7 +187,10 @@ public: 


    // helper function to obtain AudioFlinger service handle

    static sp<IAudioFlinger> get_audio_flinger();

    static sp<IAudioFlinger> get_audio_flinger_for_fuzzer();



    // function to disable creation of thread pool (Used for testing).

    // This should be called before get_audio_flinger() or get_audio_policy_service().

    static void disableThreadPool();



    static float linearToLog(int volume);

    static int logToLinear(float volume);

services/audiopolicy/fuzzer/aidl/audiopolicy_aidl_fuzzer.cpp

+3 −1
Original line number Diff line number Diff line
@@ -79,6 +79,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 
    CHECK_EQ(NO_ERROR, AServiceManager_addService(moduleService.get()->asBinder().get(),

                                                  "android.hardware.audio.core.IModule/default"));



    // Disable creating thread pool for fuzzer instance of audio flinger and audio policy services

    AudioSystem::disableThreadPool();



    const auto audioFlinger = sp<AudioFlinger>::make();

    const auto afAdapter = sp<AudioFlingerServerAdapter>::make(audioFlinger);
@@ -87,7 +90,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 
                     String16(IAudioFlinger::DEFAULT_SERVICE_NAME), IInterface::asBinder(afAdapter),

                     false /* allowIsolated */, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT));



    AudioSystem::get_audio_flinger_for_fuzzer();

    const auto audioPolicyService = sp<AudioPolicyService>::make();



    CHECK_EQ(NO_ERROR,