From dac1444e4926f94d8d9ac6b6a098ac101ce4a7be Mon Sep 17 00:00:00 2001 From: Eric Laurent Date: Thu, 1 Dec 2016 15:28:29 -0800 Subject: DO NOT MERGE - improve audio effect framwework thread safety - Reorganize handle effect creation code to make sure the effect engine is created with both thread and effect chain mutex held. - Reorganize handle disconnect code to make sure the effect engine is released with both thread and effect chain mutex held. - Protect IEffect interface methods in EffectHande with a Mutex. - Only pin effect if the session was acquired first. - Do not use strong pointer to EffectModule in EffectHandles: only the EffectChain has a single strong reference to the EffectModule. Bug: 32707507 CVE-2017-0479 CVE-2017-0480 CVE-2017-0499 Change-Id: Ia1098cba2cd32cc2d1c9dfdff4adc2388dfed80e (cherry picked from commit b378b73dd7480b584340b8028802c9ca2d625123) (cherry picked from commit 22e26d8ee73488c58ba3e7928e5da155151abfd0 with backport by ) --- services/audioflinger/AudioFlinger.cpp | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) (limited to 'services/audioflinger/AudioFlinger.cpp') diff --git a/services/audioflinger/AudioFlinger.cpp b/services/audioflinger/AudioFlinger.cpp index 23215dd..9d435e9 100644 --- a/services/audioflinger/AudioFlinger.cpp +++ b/services/audioflinger/AudioFlinger.cpp @@ -1346,7 +1346,7 @@ void AudioFlinger::removeNotificationClient(pid_t pid) ALOGV("%d died, releasing its sessions", pid); size_t num = mAudioSessionRefs.size(); bool removed = false; - for (size_t i = 0; i< num; ) { + for (size_t i = 0; i < num; ) { AudioSessionRef *ref = mAudioSessionRefs.itemAt(i); ALOGV(" pid %d @ %d", ref->mPid, i); if (ref->mPid == pid) { @@ -2343,7 +2343,7 @@ void AudioFlinger::acquireAudioSessionId(int audioSession, pid_t pid) } size_t num = mAudioSessionRefs.size(); - for (size_t i = 0; i< num; i++) { + for (size_t i = 0; i < num; i++) { AudioSessionRef *ref = mAudioSessionRefs.editItemAt(i); if (ref->mSessionid == audioSession && ref->mPid == caller) { ref->mCnt++; @@ -2364,7 +2364,7 @@ void AudioFlinger::releaseAudioSessionId(int audioSession, pid_t pid) caller = pid; } size_t num = mAudioSessionRefs.size(); - for (size_t i = 0; i< num; i++) { + for (size_t i = 0; i < num; i++) { AudioSessionRef *ref = mAudioSessionRefs.itemAt(i); if (ref->mSessionid == audioSession && ref->mPid == caller) { ref->mCnt--; @@ -2382,6 +2382,18 @@ void AudioFlinger::releaseAudioSessionId(int audioSession, pid_t pid) ALOGW_IF(caller != getpid_cached, "session id %d not found for pid %d", audioSession, caller); } +bool AudioFlinger::isSessionAcquired_l(audio_session_t audioSession) +{ + size_t num = mAudioSessionRefs.size(); + for (size_t i = 0; i < num; i++) { + AudioSessionRef *ref = mAudioSessionRefs.itemAt(i); + if (ref->mSessionid == audioSession) { + return true; + } + } + return false; +} + void AudioFlinger::purgeStaleEffects_l() { ALOGV("purging stale effects"); @@ -2723,8 +2735,9 @@ sp AudioFlinger::createEffect( sp client = registerPid(pid); // create effect on selected output thread + bool pinned = (sessionId > AUDIO_SESSION_OUTPUT_MIX) && isSessionAcquired_l((audio_session_t)sessionId); handle = thread->createEffect_l(client, effectClient, priority, sessionId, - &desc, enabled, &lStatus); + &desc, enabled, &lStatus, pinned); if (handle != 0 && id != NULL) { *id = handle->id(); } @@ -2924,7 +2937,7 @@ bool AudioFlinger::updateOrphanEffectChains(const sp ALOGV("updateOrphanEffectChains session %d index %d", session, index); if (index >= 0) { sp chain = mOrphanEffectChains.valueAt(index); - if (chain->removeEffect_l(effect) == 0) { + if (chain->removeEffect_l(effect, true) == 0) { ALOGV("updateOrphanEffectChains removing effect chain at index %d", index); mOrphanEffectChains.removeItemsAt(index); } -- cgit v1.1