From 330c8e3ff98e4cb78dad28bbacdb127da3e265ac Mon Sep 17 00:00:00 2001 From: Ravi Kumar Alamanda Date: Mon, 22 Dec 2014 10:05:29 +0530 Subject: libmediaplayerservice: fix deadlock in dump() Issue: Calling dump function while the media clients (sessions) are created and destroyed will result in a deadlock. Description: MediaPlayerService::dump() takes Mutex while calling client::dump() and right after that the strong reference to client is cleared. If there are no references to client object at this moment (which is the case if multiple audio sessions are created and destroyed) then the client destructor gets called which tries to take the same Mutex resulting in a deadlock. Fix: Take a strong reference to client objects and release them only after releasing the Mutex. Bug: 18700631 Author: Sidipotu Ashok Change-Id: I82c89771de352d2f0d914eb0a3b9fc7bfb6116b0 --- media/libmediaplayerservice/MediaPlayerService.cpp | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'media') diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp index 0b18ae0..b595b1d 100644 --- a/media/libmediaplayerservice/MediaPlayerService.cpp +++ b/media/libmediaplayerservice/MediaPlayerService.cpp @@ -441,6 +441,9 @@ status_t MediaPlayerService::dump(int fd, const Vector& args) const size_t SIZE = 256; char buffer[SIZE]; String8 result; + SortedVector< sp > clients; //to serialise the mutex unlock & client destruction. + SortedVector< sp > mediaRecorderClients; + if (checkCallingPermission(String16("android.permission.DUMP")) == false) { snprintf(buffer, SIZE, "Permission Denial: " "can't dump MediaPlayerService from pid=%d, uid=%d\n", @@ -452,6 +455,7 @@ status_t MediaPlayerService::dump(int fd, const Vector& args) for (int i = 0, n = mClients.size(); i < n; ++i) { sp c = mClients[i].promote(); if (c != 0) c->dump(fd, args); + clients.add(c); } if (mMediaRecorderClients.size() == 0) { result.append(" No media recorder client\n\n"); @@ -464,6 +468,7 @@ status_t MediaPlayerService::dump(int fd, const Vector& args) write(fd, result.string(), result.size()); result = "\n"; c->dump(fd, args); + mediaRecorderClients.add(c); } } } -- cgit v1.1