From 71d7a5c289c6ef6b5fc86dd4784a075ca6470e38 Mon Sep 17 00:00:00 2001
From: Mathias Agopian <mathias@google.com>
Date: Sun, 14 Nov 2010 20:55:25 -0800
Subject: [PATCH] Fix a race condition in sensormanager

the per-connection state assumed the main sensorservice
lock was held during access. This is however not true while
pre-processing the events just before sending them to clients.
Therefore, there was a small window during which this state
could be modified while being used.

we now have an internal lock that protects this state.

Change-Id: I594680f20f09d6a4f1f38f093a1d3f650dcef1be
---
 services/sensorservice/SensorService.cpp | 6 ++++++
 services/sensorservice/SensorService.h   | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index b5e73ac5e7..22a45df060 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -464,6 +464,7 @@ void SensorService::SensorEventConnection::onFirstRef()
 }
 
 bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.indexOfKey(handle) <= 0) {
         SensorInfo info;
         mSensorInfo.add(handle, info);
@@ -473,6 +474,7 @@ bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
+    Mutex::Autolock _l(mConnectionLock);
     if (mSensorInfo.removeItem(handle) >= 0) {
         return true;
     }
@@ -480,16 +482,19 @@ bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
 }
 
 bool SensorService::SensorEventConnection::hasSensor(int32_t handle) const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.indexOfKey(handle) >= 0;
 }
 
 bool SensorService::SensorEventConnection::hasAnySensor() const {
+    Mutex::Autolock _l(mConnectionLock);
     return mSensorInfo.size() ? true : false;
 }
 
 status_t SensorService::SensorEventConnection::setEventRateLocked(
         int handle, nsecs_t ns)
 {
+    Mutex::Autolock _l(mConnectionLock);
     ssize_t index = mSensorInfo.indexOfKey(handle);
     if (index >= 0) {
         SensorInfo& info = mSensorInfo.editValueFor(handle);
@@ -506,6 +511,7 @@ status_t SensorService::SensorEventConnection::sendEvents(
     // filter out events not for this connection
     size_t count = 0;
     if (scratch) {
+        Mutex::Autolock _l(mConnectionLock);
         size_t i=0;
         while (i<numEvents) {
             const int32_t curr = buffer[i].sensor;
diff --git a/services/sensorservice/SensorService.h b/services/sensorservice/SensorService.h
index b442779d5a..c0922f553c 100644
--- a/services/sensorservice/SensorService.h
+++ b/services/sensorservice/SensorService.h
@@ -75,8 +75,9 @@ class SensorService :
 
         sp<SensorService> const mService;
         sp<SensorChannel> const mChannel;
+        mutable Mutex mConnectionLock;
 
-        // protected by SensorService::mLock
+        // protected mConnectionLock
         struct SensorInfo {
             SensorInfo() : ns(DEFAULT_EVENTS_PERIOD) { }
             nsecs_t ns;
-- 
2.11.0