Fix race condition in fallback key processing.

Need to ensure that the channel is still valid before proceeding.

Bug: 3271482
Change-Id: Ia6863cbedd9b53cbc5c9c8815e9ea90bef3d2218

1 files changed, 12 insertions, 4 deletions

diff --git a/libs/ui/InputDispatcher.cpp b/libs/ui/InputDispatcher.cpp
index 1f6a920..ed0cb8e 100644
--- a/libs/ui/InputDispatcher.cpp
+++ b/libs/ui/InputDispatcher.cpp
@@ -908,9 +908,11 @@ void InputDispatcher::resumeAfterTargetsNotReadyTimeoutLocked(nsecs_t newTimeout
             ssize_t connectionIndex = getConnectionIndexLocked(inputChannel);
             if (connectionIndex >= 0) {
                 sp<Connection> connection = mConnectionsByReceiveFd.valueAt(connectionIndex);
-                synthesizeCancelationEventsForConnectionLocked(
-                        connection, InputState::CANCEL_ALL_EVENTS,
-                        "application not responding");
+                if (connection->status == Connection::STATUS_NORMAL) {
+                    synthesizeCancelationEventsForConnectionLocked(
+                            connection, InputState::CANCEL_ALL_EVENTS,
+                            "application not responding");
+                }
             }
         }
     }
@@ -3056,7 +3058,7 @@ void InputDispatcher::doDispatchCycleFinishedLockedInterruptible(
                     // the original UP in which case we would not generate the fallback UP.
                     synthesizeCancelationEventsForConnectionLocked(connection,
                             InputState::CANCEL_FALLBACK_EVENTS,
-                            "Application handled a non-fallback event.");
+                            "application handled a non-fallback event, canceling all fallback events");
                 } else {
                     // If the application did not handle a non-fallback key, then ask
                     // the policy what to do with it.  We might generate a fallback key
@@ -3071,6 +3073,12 @@ void InputDispatcher::doDispatchCycleFinishedLockedInterruptible(
 
                     mLock.lock();
 
+                    if (connection->status != Connection::STATUS_NORMAL) {
+                        return;
+                    }
+
+                    assert(connection->outboundQueue.headSentinel.next == dispatchEntry);
+
                     if (fallback) {
                         // Restart the dispatch cycle using the fallback key.
                         keyEntry->eventTime = event.getEventTime();