audio service: fix regression in startBluetoothSco

Commit 2a57ca93 introduced a regression in startBluetoothSco()
where the calling pid was cleared before creating the entry for
the client app. The pid in the entry was always the system server pid
and the SCO client verification logic was broken preventing the activation
of the BT SCO connection.

Change-Id: I4e024b22fceb350f829ff0d8664703faeef7af48

1 files changed, 10 insertions, 2 deletions

diff --git a/media/java/android/media/AudioService.java b/media/java/android/media/AudioService.java
index 882a635..f0a5c28 100644
--- a/media/java/android/media/AudioService.java
+++ b/media/java/android/media/AudioService.java
@@ -1948,8 +1948,13 @@ public class AudioService extends IAudioService.Stub implements OnFinished {
                 !mBootCompleted) {
             return;
         }
-        final long ident = Binder.clearCallingIdentity();
         ScoClient client = getScoClient(cb, true);
+        // The calling identity must be cleared before calling ScoClient.incCount().
+        // inCount() calls requestScoState() which in turn can call BluetoothHeadset APIs
+        // and this must be done on behalf of system server to make sure permissions are granted.
+        // The caller identity must be cleared after getScoClient() because it is needed if a new
+        // client is created.
+        final long ident = Binder.clearCallingIdentity();
         client.incCount();
         Binder.restoreCallingIdentity(ident);
     }
@@ -1960,8 +1965,11 @@ public class AudioService extends IAudioService.Stub implements OnFinished {
                 !mBootCompleted) {
             return;
         }
-        final long ident = Binder.clearCallingIdentity();
         ScoClient client = getScoClient(cb, false);
+        // The calling identity must be cleared before calling ScoClient.decCount().
+        // decCount() calls requestScoState() which in turn can call BluetoothHeadset APIs
+        // and this must be done on behalf of system server to make sure permissions are granted.
+        final long ident = Binder.clearCallingIdentity();
         if (client != null) {
             client.decCount();
         }