Fix a race condition in sensormanager

the per-connection state assumed the main sensorservice
lock was held during access. This is however not true while
pre-processing the events just before sending them to clients.
Therefore, there was a small window during which this state
could be modified while being used.

we now have an internal lock that protects this state.

Change-Id: I594680f20f09d6a4f1f38f093a1d3f650dcef1be

2 files changed, 8 insertions, 1 deletions

diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index b5e73ac..22a45df 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -464,6 +464,7 @@ void SensorService::SensorEventConnection::onFirstRef()
 }
 
 bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.indexOfKey(handle) <= 0) {
         SensorInfo info;
         mSensorInfo.add(handle, info);
@@ -473,6 +474,7 @@ bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.removeItem(handle) >= 0) {
         return true;
     }
@@ -480,16 +482,19 @@ bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::hasSensor(int32_t handle) const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.indexOfKey(handle) >= 0;
 }
 
 bool SensorService::SensorEventConnection::hasAnySensor() const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.size() ? true : false;
 }
 
 status_t SensorService::SensorEventConnection::setEventRateLocked(
         int handle, nsecs_t ns)
 {
+    Mutex::Autolock _l(mConnectionLock);
     ssize_t index = mSensorInfo.indexOfKey(handle);
     if (index >= 0) {
         SensorInfo& info = mSensorInfo.editValueFor(handle);
@@ -506,6 +511,7 @@ status_t SensorService::SensorEventConnection::sendEvents(
     // filter out events not for this connection
     size_t count = 0;
     if (scratch) {
+        Mutex::Autolock _l(mConnectionLock);
         size_t i=0;
         while (i<numEvents) {
             const int32_t curr = buffer[i].sensor;
diff --git a/services/sensorservice/SensorService.h b/services/sensorservice/SensorService.h
index b442779..c0922f5 100644
--- a/services/sensorservice/SensorService.h
+++ b/services/sensorservice/SensorService.h
@@ -75,8 +75,9 @@ class SensorService :
 
         sp<SensorService> const mService;
         sp<SensorChannel> const mChannel;
+        mutable Mutex mConnectionLock;
 
-        // protected by SensorService::mLock
+        // protected mConnectionLock
         struct SensorInfo {
             SensorInfo() : ns(DEFAULT_EVENTS_PERIOD) { }
             nsecs_t ns;