MidiDeviceServer: Fix race condition in setting device server's mDeviceInfo

This made it unsafe to open ports on a device from the MidiManager onDeviceOpened callback

Bug: 21760692
Change-Id: I536acdf574a3ccecdb66a8fde87089538e8bb1ef

4 files changed, 21 insertions, 11 deletions

diff --git a/media/java/android/media/midi/IMidiDeviceServer.aidl b/media/java/android/media/midi/IMidiDeviceServer.aidl
index e30796d..c2cc2b9 100644
--- a/media/java/android/media/midi/IMidiDeviceServer.aidl
+++ b/media/java/android/media/midi/IMidiDeviceServer.aidl
@@ -31,4 +31,5 @@ interface IMidiDeviceServer
     void connectPorts(IBinder token, in ParcelFileDescriptor pfd, int outputPortNumber);
 
     MidiDeviceInfo getDeviceInfo();
+    void setDeviceInfo(in MidiDeviceInfo deviceInfo);
 }
diff --git a/media/java/android/media/midi/MidiDeviceServer.java b/media/java/android/media/midi/MidiDeviceServer.java
index 1b56e1c..1212b64 100644
--- a/media/java/android/media/midi/MidiDeviceServer.java
+++ b/media/java/android/media/midi/MidiDeviceServer.java
@@ -269,8 +269,20 @@ public final class MidiDeviceServer implements Closeable {
         public MidiDeviceInfo getDeviceInfo() {
             return mDeviceInfo;
         }
+
+        @Override
+        public void setDeviceInfo(MidiDeviceInfo deviceInfo) {
+            if (Binder.getCallingUid() != Process.SYSTEM_UID) {
+                throw new SecurityException("setDeviceInfo should only be called by MidiService");
+            }
+            if (mDeviceInfo != null) {
+                throw new IllegalStateException("setDeviceInfo should only be called once");
+            }
+            mDeviceInfo = deviceInfo;
+        }
     };
 
+    // Constructor for MidiManager.createDeviceServer()
     /* package */ MidiDeviceServer(IMidiManager midiManager, MidiReceiver[] inputPortReceivers,
             int numOutputPorts, Callback callback) {
         mMidiManager = midiManager;
@@ -292,6 +304,13 @@ public final class MidiDeviceServer implements Closeable {
         mGuard.open("close");
     }
 
+    // Constructor for MidiDeviceService.onCreate()
+    /* package */ MidiDeviceServer(IMidiManager midiManager, MidiReceiver[] inputPortReceivers,
+           MidiDeviceInfo deviceInfo, Callback callback) {
+        this(midiManager, inputPortReceivers, deviceInfo.getOutputPortCount(), callback);
+        mDeviceInfo = deviceInfo;
+    }
+
     /* package */ IMidiDeviceServer getBinderInterface() {
         return mServer;
     }
@@ -300,13 +319,6 @@ public final class MidiDeviceServer implements Closeable {
         return mServer.asBinder();
     }
 
-    /* package */ void setDeviceInfo(MidiDeviceInfo deviceInfo) {
-        if (mDeviceInfo != null) {
-            throw new IllegalStateException("setDeviceInfo should only be called once");
-        }
-        mDeviceInfo = deviceInfo;
-    }
-
     private void updateDeviceStatus() {
         // clear calling identity, since we may be in a Binder call from one of our clients
         long identityToken = Binder.clearCallingIdentity();
diff --git a/media/java/android/media/midi/MidiDeviceService.java b/media/java/android/media/midi/MidiDeviceService.java
index d897ad2..388d95b 100644
--- a/media/java/android/media/midi/MidiDeviceService.java
+++ b/media/java/android/media/midi/MidiDeviceService.java
@@ -83,9 +83,7 @@ abstract public class MidiDeviceService extends Service {
             if (inputPortReceivers == null) {
                 inputPortReceivers = new MidiReceiver[0];
             }
-            server = new MidiDeviceServer(mMidiManager, inputPortReceivers,
-                    deviceInfo.getOutputPortCount(), mCallback);
-            server.setDeviceInfo(deviceInfo);
+            server = new MidiDeviceServer(mMidiManager, inputPortReceivers, deviceInfo, mCallback);
         } catch (RemoteException e) {
             Log.e(TAG, "RemoteException in IMidiManager.getServiceDeviceInfo");
             server = null;
diff --git a/media/java/android/media/midi/MidiManager.java b/media/java/android/media/midi/MidiManager.java
index 0beb9a4..89230fe 100644
--- a/media/java/android/media/midi/MidiManager.java
+++ b/media/java/android/media/midi/MidiManager.java
@@ -318,7 +318,6 @@ public final class MidiManager {
                 Log.e(TAG, "registerVirtualDevice failed");
                 return null;
             }
-            server.setDeviceInfo(deviceInfo);
             return server;
         } catch (RemoteException e) {
             Log.e(TAG, "RemoteException in createVirtualDevice");