libmediaplayerservice: fix deadlock in dump()

Issue: Calling dump function while the media clients
(sessions) are created and destroyed will result in a deadlock.

Description: MediaPlayerService::dump() takes Mutex while calling
client::dump() and right after that the strong reference to client
is cleared. If there are no references to client object at this moment
(which is the case if multiple audio sessions are created and destroyed)
then the client destructor gets called which tries to take
the same Mutex resulting in a deadlock.

Fix: Take a strong reference to client objects and release them only
after releasing the Mutex.

Bug: 18700631

Author: Sidipotu Ashok<sashok@codeaurora.org>

Change-Id: I82c89771de352d2f0d914eb0a3b9fc7bfb6116b0

1 files changed, 5 insertions, 0 deletions

diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index 0b18ae0..b595b1d 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -441,6 +441,9 @@ status_t MediaPlayerService::dump(int fd, const Vector<String16>& args)
     const size_t SIZE = 256;
     char buffer[SIZE];
     String8 result;
+    SortedVector< sp<Client> > clients; //to serialise the mutex unlock & client destruction.
+    SortedVector< sp<MediaRecorderClient> > mediaRecorderClients;
+
     if (checkCallingPermission(String16("android.permission.DUMP")) == false) {
         snprintf(buffer, SIZE, "Permission Denial: "
                 "can't dump MediaPlayerService from pid=%d, uid=%d\n",
@@ -452,6 +455,7 @@ status_t MediaPlayerService::dump(int fd, const Vector<String16>& args)
         for (int i = 0, n = mClients.size(); i < n; ++i) {
             sp<Client> c = mClients[i].promote();
             if (c != 0) c->dump(fd, args);
+            clients.add(c);
         }
         if (mMediaRecorderClients.size() == 0) {
                 result.append(" No media recorder client\n\n");
@@ -464,6 +468,7 @@ status_t MediaPlayerService::dump(int fd, const Vector<String16>& args)
                     write(fd, result.string(), result.size());
                     result = "\n";
                     c->dump(fd, args);
+                    mediaRecorderClients.add(c);
                 }
             }
         }