Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3bf1ac54 authored by Andre Eisenbach's avatar Andre Eisenbach
Browse files

Bluetooth: Don't call beginBroadcast() while in a broadcast 

Block duplicate calls to beginBroadcast() and add try/finally
to ensure finishBroadcast() is always called.

Bug: 22800686
Change-Id: Ie8d4005f4cd50dd2544a2832773d72eab0015d92
parent 26ae600b

services/core/java/com/android/server/BluetoothManagerService.java

+71 −41
Original line number Diff line number Diff line
@@ -805,6 +805,7 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
        IBinder mService;

        ComponentName mClassName;

        Intent mIntent;

        boolean mInvokingProxyCallbacks = false;



        ProfileServiceConnections(Intent intent) {

            mService = null;
@@ -871,7 +872,15 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
            } catch (RemoteException e) {

                Log.e(TAG, "Unable to linkToDeath", e);

            }

            int n = mProxies.beginBroadcast();



            if (mInvokingProxyCallbacks) {

                Log.e(TAG, "Proxy callbacks already in progress.");

                return;

            }

            mInvokingProxyCallbacks = true;



            final int n = mProxies.beginBroadcast();

            try {

                for (int i = 0; i < n; i++) {

                    try {

                        mProxies.getBroadcastItem(i).onServiceConnected(className, service);
@@ -879,18 +888,27 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
                        Log.e(TAG, "Unable to connect to proxy", e);

                    }

                }

            } finally {

                mProxies.finishBroadcast();

                mInvokingProxyCallbacks = false;

            }

        }



        @Override

        public void onServiceDisconnected(ComponentName className) {

            if (mService == null) {

                return;

            }

            if (mService == null) return;

            mService.unlinkToDeath(this, 0);

            mService = null;

            mClassName = null;

            int n = mProxies.beginBroadcast();



            if (mInvokingProxyCallbacks) {

                Log.e(TAG, "Proxy callbacks already in progress.");

                return;

            }

            mInvokingProxyCallbacks = true;



            final int n = mProxies.beginBroadcast();

            try {

                for (int i = 0; i < n; i++) {

                    try {

                        mProxies.getBroadcastItem(i).onServiceDisconnected(className);
@@ -898,7 +916,10 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
                        Log.e(TAG, "Unable to disconnect from proxy", e);

                    }

                }

            } finally {

                mProxies.finishBroadcast();

                mInvokingProxyCallbacks = false;

            }

        }



        @Override
@@ -916,6 +937,7 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
    }



    private void sendBluetoothStateCallback(boolean isUp) {

        try {

            int n = mStateChangeCallbacks.beginBroadcast();

            if (DBG) Log.d(TAG,"Broadcasting onBluetoothStateChange("+isUp+") to " + n + " receivers.");

            for (int i=0; i <n;i++) {
@@ -925,8 +947,10 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
                    Log.e(TAG, "Unable to call onBluetoothStateChange() on callback #" + i , e);

                }

            }

        } finally {

            mStateChangeCallbacks.finishBroadcast();

        }

    }



    /**

     * Inform BluetoothAdapter instances that Adapter service is up
@@ -934,6 +958,7 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
    private void sendBluetoothServiceUpCallback() {

        if (!mConnection.isGetNameAddressOnly()) {

            if (DBG) Log.d(TAG,"Calling onBluetoothServiceUp callbacks");

            try {

                int n = mCallbacks.beginBroadcast();

                Log.d(TAG,"Broadcasting onBluetoothServiceUp() to " + n + " receivers.");

                for (int i=0; i <n;i++) {
@@ -943,15 +968,18 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
                        Log.e(TAG, "Unable to call onBluetoothServiceUp() on callback #" + i, e);

                    }

                }

            } finally {

                mCallbacks.finishBroadcast();

            }

        }

    }

    /**

     * Inform BluetoothAdapter instances that Adapter service is down

     */

    private void sendBluetoothServiceDownCallback() {

        if (!mConnection.isGetNameAddressOnly()) {

            if (DBG) Log.d(TAG,"Calling onBluetoothServiceDown callbacks");

            try {

                int n = mCallbacks.beginBroadcast();

                Log.d(TAG,"Broadcasting onBluetoothServiceDown() to " + n + " receivers.");

                for (int i=0; i <n;i++) {
@@ -961,9 +989,11 @@ class BluetoothManagerService extends IBluetoothManager.Stub { 
                        Log.e(TAG, "Unable to call onBluetoothServiceDown() on callback #" + i, e);

                    }

                }

            } finally {

                mCallbacks.finishBroadcast();

            }

        }

    }



    public String getAddress() {

        mContext.enforceCallingOrSelfPermission(BLUETOOTH_PERM,