Reroute submix HAL: fix race condition on output state

When reading from a pipe, the output may have been previously
 closed, therefore the output state should only be read if it
 is still available.
This fixes a race condition observed between in_read() (which
 accesses the output stream) and adev_close_output_stream()
 (which sets the output reference to NULL).
 No issue with out_write() which checks the input reference.

Bug 16009464

Change-Id: I979bc12c8fe91fad9b6f6c9e0be107c1bacae360

1 files changed, 4 insertions, 3 deletions

diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index bd50246..b9dcf7a 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -1036,9 +1036,10 @@ static ssize_t in_read(struct audio_stream_in *stream, void* buffer,
     SUBMIX_ALOGV("in_read bytes=%zu", bytes);
     pthread_mutex_lock(&rsxadev->lock);
 
-    const bool output_standby_transition =
-            (in->output_standby_rec_thr != rsxadev->routes[in->route_handle].output->output_standby);
-    in->output_standby_rec_thr = rsxadev->routes[in->route_handle].output->output_standby;
+    const bool output_standby = rsxadev->routes[in->route_handle].output == NULL
+            ? true : rsxadev->routes[in->route_handle].output->output_standby;
+    const bool output_standby_transition = (in->output_standby_rec_thr != output_standby);
+    in->output_standby_rec_thr = output_standby;
 
     if (in->input_standby || output_standby_transition) {
         in->input_standby = false;