Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8856f72 authored by Marvin Ramin's avatar Marvin Ramin
Browse files

Prevent double-closure of VirtualDeviceImpl 

In certain conditions VirtualDeviceImpl#close() can execute twice
causing system server to crash.

Bug: 278934835
Test: atest VirtualDeviceManagerBasicTest
Change-Id: I48269b105d5019fcd12fd5f949be507ba8bc0eb5
parent ff4a844c

services/companion/java/com/android/server/companion/virtual/VirtualDeviceImpl.java

+32 −27
Original line number Diff line number Diff line
@@ -404,9 +404,16 @@ final class VirtualDeviceImpl extends IVirtualDevice.Stub 
    public void close() {

        super.close_enforcePermission();

        // Remove about-to-be-closed virtual device from the service before butchering it.

        mService.removeVirtualDevice(mDeviceId);

        boolean removed = mService.removeVirtualDevice(mDeviceId);

        mDeviceId = Context.DEVICE_ID_INVALID;



        // Device is already closed.

        if (!removed) {

            return;

        }



        final long ident = Binder.clearCallingIdentity();

        try {

            VirtualDisplayWrapper[] virtualDisplaysToBeReleased;

            synchronized (mVirtualDeviceLock) {

                if (mVirtualAudioController != null) {
@@ -427,16 +434,14 @@ final class VirtualDeviceImpl extends IVirtualDevice.Stub 
                mDisplayManager.releaseVirtualDisplay(virtualDisplayWrapper.getToken());

                // The releaseVirtualDisplay call above won't trigger

                // VirtualDeviceImpl.onVirtualDisplayRemoved callback because we already removed the

            // virtual device from the service - we release the other display-tied resources here

            // with the guarantee it will be done exactly once.

                // virtual device from the service - we release the other display-tied resources

                // here with the guarantee it will be done exactly once.

                releaseOwnedVirtualDisplayResources(virtualDisplayWrapper);

            }



            mAppToken.unlinkToDeath(this, 0);

            mCameraAccessController.stopObservingIfNeeded();



        final long ident = Binder.clearCallingIdentity();

        try {

            mInputController.close();

            mSensorController.close();

        } finally {

services/companion/java/com/android/server/companion/virtual/VirtualDeviceManagerService.java

+13 −2
Original line number Diff line number Diff line
@@ -202,8 +202,19 @@ public class VirtualDeviceManagerService extends SystemService { 
        }

    }



    void removeVirtualDevice(int deviceId) {

    /**

     * Remove the virtual device. Sends the

     * {@link VirtualDeviceManager#ACTION_VIRTUAL_DEVICE_REMOVED} broadcast as a result.

     *

     * @param deviceId deviceId to be removed

     * @return {@code true} if the device was removed, {@code false} if the operation was a no-op

     */

    boolean removeVirtualDevice(int deviceId) {

        synchronized (mVirtualDeviceManagerLock) {

            if (!mVirtualDevices.contains(deviceId)) {

                return false;

            }



            mAppsOnVirtualDevices.remove(deviceId);

            mVirtualDevices.remove(deviceId);

        }
@@ -223,6 +234,7 @@ public class VirtualDeviceManagerService extends SystemService { 
        } finally {

            Binder.restoreCallingIdentity(identity);

        }

        return true;

    }



    private void syncVirtualDevicesToCdmAssociations(List<AssociationInfo> associations) {
@@ -248,7 +260,6 @@ public class VirtualDeviceManagerService extends SystemService { 
        for (VirtualDeviceImpl virtualDevice : virtualDevicesToRemove) {

            virtualDevice.close();

        }



    }



    private void registerCdmAssociationListener() {