diff options
| author | Mike Lockwood <lockwood@google.com> | 2014-05-20 18:59:05 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2014-05-20 18:59:05 +0000 |
| commit | 304ebe60b215d11b534afb550f46150205d1632a (patch) | |
| tree | e227b5ee30f6f61ed59a295972a31b6df83cdd20 /core/jni | |
| parent | 5633e37ec10e0d873acec9c64a091ab0a97caf75 (diff) | |
| parent | b2a4658a630a99b0e0ff44bc54aa5b02557a571b (diff) | |
| download | frameworks_base-304ebe60b215d11b534afb550f46150205d1632a.zip frameworks_base-304ebe60b215d11b534afb550f46150205d1632a.tar.gz frameworks_base-304ebe60b215d11b534afb550f46150205d1632a.tar.bz2 | |
Merge "USB: Fix race condition in acquiring global reference in UsbRequest JNI code"
Diffstat (limited to 'core/jni')
| -rw-r--r-- | core/jni/android_hardware_UsbRequest.cpp | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/core/jni/android_hardware_UsbRequest.cpp b/core/jni/android_hardware_UsbRequest.cpp index 01eaec4..a3c7b0a 100644 --- a/core/jni/android_hardware_UsbRequest.cpp +++ b/core/jni/android_hardware_UsbRequest.cpp @@ -100,18 +100,19 @@ android_hardware_UsbRequest_queue_array(JNIEnv *env, jobject thiz, } request->buffer_length = length; + // save a reference to ourselves so UsbDeviceConnection.waitRequest() can find us + request->client_data = (void *)env->NewGlobalRef(thiz); + if (usb_request_queue(request)) { if (request->buffer) { // free our buffer if usb_request_queue fails free(request->buffer); request->buffer = NULL; } + env->DeleteGlobalRef((jobject)request->client_data); return false; - } else { - // save a reference to ourselves so UsbDeviceConnection.waitRequest() can find us - request->client_data = (void *)env->NewGlobalRef(thiz); - return true; } + return true; } static jint @@ -152,16 +153,17 @@ android_hardware_UsbRequest_queue_direct(JNIEnv *env, jobject thiz, } request->buffer_length = length; + // save a reference to ourselves so UsbDeviceConnection.waitRequest() can find us + // we also need this to make sure our native buffer is not deallocated + // while IO is active + request->client_data = (void *)env->NewGlobalRef(thiz); + if (usb_request_queue(request)) { request->buffer = NULL; + env->DeleteGlobalRef((jobject)request->client_data); return false; - } else { - // save a reference to ourselves so UsbDeviceConnection.waitRequest() can find us - // we also need this to make sure our native buffer is not deallocated - // while IO is active - request->client_data = (void *)env->NewGlobalRef(thiz); - return true; } + return true; } static jint |