Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cd71ff6 authored by Sanket Padawe's avatar Sanket Padawe
Browse files

Fix race condition leading to crash in RIL.java. 

+ Crash occuring because of using RilRequest object after releasing it.

Bug: 28855244

Change-Id: Ieb337a2403ba76de37c4f06a99845709863f19b9
(cherry picked from commit d0fdd8bd)
parent fc589fc2

src/java/com/android/internal/telephony/RIL.java

+7 −2
Original line number Diff line number Diff line
@@ -424,6 +424,10 @@ public final class RIL extends BaseCommands implements CommandsInterface { 


                        s.getOutputStream().write(dataLength);

                        s.getOutputStream().write(data);

                        if (msg.what == EVENT_SEND_ACK) {

                            rr.release();

                            return;

                        }

                    } catch (IOException ex) {

                        Rlog.e(RILJ_LOG_TAG, "IOException", ex);

                        req = findAndRemoveRequestFromList(rr.mSerial);
@@ -433,6 +437,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                            rr.onError(RADIO_NOT_AVAILABLE, null);

                            decrementWakeLock(rr);

                            rr.release();

                            return;

                        }

                    } catch (RuntimeException exc) {

                        Rlog.e(RILJ_LOG_TAG, "Uncaught exception ", exc);
@@ -443,6 +448,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                            rr.onError(GENERIC_FAILURE, null);

                            decrementWakeLock(rr);

                            rr.release();

                            return;

                        }

                    }
@@ -2553,6 +2559,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                    decrementWakeLock(rr);

                }

                rr.release();

                return;

            }

        } else if (type == RESPONSE_SOLICITED_ACK) {

            int serial;
@@ -2642,7 +2649,6 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                riljLog("Response received for " + rr.serialString() + " " +

                        requestToString(rr.mRequest) + " Sending ack to ril.cpp");

            }

            response.release();

        }
@@ -3010,7 +3016,6 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                riljLog("Unsol response received for " + responseToString(response) +

                        " Sending ack to ril.cpp");

            }

            rr.release();

        }



        try {switch(response) {