From: Mathias Agopian <mathias@google.com>
Date: Mon, 15 Nov 2010 04:55:25 +0000 (-0800)
Subject: Fix a race condition in sensormanager
X-Git-Tag: android-x86-4.4-r1~845^2~38
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=71d7a5c289c6ef6b5fc86dd4784a075ca6470e38;p=android-x86%2Fframeworks-native.git

Fix a race condition in sensormanager

the per-connection state assumed the main sensorservice
lock was held during access. This is however not true while
pre-processing the events just before sending them to clients.
Therefore, there was a small window during which this state
could be modified while being used.

we now have an internal lock that protects this state.

Change-Id: I594680f20f09d6a4f1f38f093a1d3f650dcef1be
---

diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index b5e73ac5e7..22a45df060 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -464,6 +464,7 @@ void SensorService::SensorEventConnection::onFirstRef()
 }
 
 bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.indexOfKey(handle) <= 0) {
         SensorInfo info;
         mSensorInfo.add(handle, info);
@@ -473,6 +474,7 @@ bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.removeItem(handle) >= 0) {
         return true;
     }
@@ -480,16 +482,19 @@ bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::hasSensor(int32_t handle) const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.indexOfKey(handle) >= 0;
 }
 
 bool SensorService::SensorEventConnection::hasAnySensor() const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.size() ? true : false;
 }
 
 status_t SensorService::SensorEventConnection::setEventRateLocked(
         int handle, nsecs_t ns)
 {
+    Mutex::Autolock _l(mConnectionLock);
     ssize_t index = mSensorInfo.indexOfKey(handle);
     if (index >= 0) {
         SensorInfo& info = mSensorInfo.editValueFor(handle);
@@ -506,6 +511,7 @@ status_t SensorService::SensorEventConnection::sendEvents(
     // filter out events not for this connection
     size_t count = 0;
     if (scratch) {
+        Mutex::Autolock _l(mConnectionLock);
         size_t i=0;
         while (i<numEvents) {
             const int32_t curr = buffer[i].sensor;
diff --git a/services/sensorservice/SensorService.h b/services/sensorservice/SensorService.h
index b442779d5a..c0922f553c 100644
--- a/services/sensorservice/SensorService.h
+++ b/services/sensorservice/SensorService.h
@@ -75,8 +75,9 @@ class SensorService :
 
         sp<SensorService> const mService;
         sp<SensorChannel> const mChannel;
+        mutable Mutex mConnectionLock;
 
-        // protected by SensorService::mLock
+        // protected mConnectionLock
         struct SensorInfo {
             SensorInfo() : ns(DEFAULT_EVENTS_PERIOD) { }
             nsecs_t ns;