Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0fdd8bd authored by Sanket Padawe's avatar Sanket Padawe
Browse files

Fix race condition leading to crash in RIL.java. 

+ Crash occuring because of using RilRequest object after releasing it.

Bug: 28855244

Change-Id: Ieb337a2403ba76de37c4f06a99845709863f19b9
parent 43e44896

src/java/com/android/internal/telephony/RIL.java

+7 −2
Original line number Original line Diff line number Diff line
@@ -444,6 +444,10 @@ public final class RIL extends BaseCommands implements CommandsInterface { 




                        s.getOutputStream().write(dataLength);

                        s.getOutputStream().write(dataLength);

                        s.getOutputStream().write(data);

                        s.getOutputStream().write(data);

                        if (msg.what == EVENT_SEND_ACK) {

                            rr.release();

                            return;

                        }

                    } catch (IOException ex) {

                    } catch (IOException ex) {

                        Rlog.e(RILJ_LOG_TAG, "IOException", ex);

                        Rlog.e(RILJ_LOG_TAG, "IOException", ex);

                        req = findAndRemoveRequestFromList(rr.mSerial);

                        req = findAndRemoveRequestFromList(rr.mSerial);
@@ -453,6 +457,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                            rr.onError(RADIO_NOT_AVAILABLE, null);

                            rr.onError(RADIO_NOT_AVAILABLE, null);

                            decrementWakeLock(rr);

                            decrementWakeLock(rr);

                            rr.release();

                            rr.release();

                            return;

                        }

                        }

                    } catch (RuntimeException exc) {

                    } catch (RuntimeException exc) {

                        Rlog.e(RILJ_LOG_TAG, "Uncaught exception ", exc);

                        Rlog.e(RILJ_LOG_TAG, "Uncaught exception ", exc);
@@ -463,6 +468,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                            rr.onError(GENERIC_FAILURE, null);

                            rr.onError(GENERIC_FAILURE, null);

                            decrementWakeLock(rr);

                            decrementWakeLock(rr);

                            rr.release();

                            rr.release();

                            return;

                        }

                        }

                    }

                    }
@@ -2573,6 +2579,7 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                    decrementWakeLock(rr);

                    decrementWakeLock(rr);

                }

                }

                rr.release();

                rr.release();

                return;

            }

            }

        } else if (type == RESPONSE_SOLICITED_ACK) {

        } else if (type == RESPONSE_SOLICITED_ACK) {

            int serial;

            int serial;
@@ -2681,7 +2688,6 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                riljLog("Response received for " + rr.serialString() + " " +

                riljLog("Response received for " + rr.serialString() + " " +

                        requestToString(rr.mRequest) + " Sending ack to ril.cpp");

                        requestToString(rr.mRequest) + " Sending ack to ril.cpp");

            }

            }

            response.release();

        }

        }
@@ -3049,7 +3055,6 @@ public final class RIL extends BaseCommands implements CommandsInterface { 
                riljLog("Unsol response received for " + responseToString(response) +

                riljLog("Unsol response received for " + responseToString(response) +

                        " Sending ack to ril.cpp");

                        " Sending ack to ril.cpp");

            }

            }

            rr.release();

        }

        }





        try {switch(response) {

        try {switch(response) {