commit 1c204929203d362f752b13dc0955962f3bbdab81
author haobo10173529 <hao.bo15@zte.com.cn> Fri Mar 17 17:44:03 2017 +0800
committer Andy Hung <hunga@google.com> Fri Mar 16 21:03:33 2018 +0000
tree cca1dd5f91b8da3ce3f703d8ab027758d8d7c23d
parent fa87fc3b31e273efe3a2f5090dcd9c283e414aa5

AudioFlinger: Fix deadlock when createEffect_l fails.

The handle.clear() will cause deadlock if init of EffectHandle
failed due to NO_MEMORY in createEffect_l.

Test: Monkey test, Instrumented test.
Bug: 75031792
Change-Id: Ie0f38d76a66aeafe26903dda6690d1fe7fca4464

services/audioflinger/AudioFlinger.cpp

diff --git a/services/audioflinger/AudioFlinger.cpp b/services/audioflinger/AudioFlinger.cpp
index 91f4d37..115a925 100644
--- a/services/audioflinger/AudioFlinger.cpp
+++ b/services/audioflinger/AudioFlinger.cpp
@@ -3041,16 +3041,21 @@
         bool pinned = (sessionId > AUDIO_SESSION_OUTPUT_MIX) && isSessionAcquired_l(sessionId);
         handle = thread->createEffect_l(client, effectClient, priority, sessionId,
                 &desc, enabled, &lStatus, pinned);
-        if (handle != 0 && id != NULL) {
-            *id = handle->id();
-        }
-        if (handle == 0) {
+        if (lStatus != NO_ERROR && lStatus != ALREADY_EXISTS) {
             // remove local strong reference to Client with mClientLock held
             Mutex::Autolock _cl(mClientLock);
             client.clear();
+        } else {
+            // handle must be valid here, but check again to be safe.
+            if (handle.get() != nullptr && id != nullptr) *id = handle->id();
         }
     }
 
+    if (lStatus != NO_ERROR && lStatus != ALREADY_EXISTS) {
+        // handle must be cleared outside lock.
+        handle.clear();
+    }
+
 Exit:
     *status = lStatus;
     return handle;

services/audioflinger/Threads.cpp

diff --git a/services/audioflinger/Threads.cpp b/services/audioflinger/Threads.cpp
index 2aa14e6..e78445e 100644
--- a/services/audioflinger/Threads.cpp
+++ b/services/audioflinger/Threads.cpp
@@ -1354,7 +1354,7 @@
         if (chainCreated) {
             removeEffectChain_l(chain);
         }
-        handle.clear();
+        // handle must be cleared by caller to avoid deadlock.
     }
 
     *status = lStatus;