commit 76b18390990156fa09a204cf51fc67aee3a6886d
author Matthew Bouyack <mbouyack@google.com> Mon May 21 16:18:10 2018 -0700
committer Ben Fennema <fennema@google.com> Fri Jun 01 09:30:00 2018 -0700
tree 671ab0dd9ad10d8cc15c7da63d5d12356f83f86f
parent 0de12d480ad03ab5f1146f5b20f708d5a7b69d94

Protect accesses to mFlushesPending.

Previously we weren't taking 'mLock' before accessing mFlushesPending
introducing a possible race condition.

Bug: 79994899
Change-Id: I382e0aa5879b8804718f0c41cf648910d88dee53
Merged-In: I9753d4ffc55c81716a80aefc2e8368f9b727484c

sensorhal/hubconnection.cpp

diff --git a/sensorhal/hubconnection.cpp b/sensorhal/hubconnection.cpp
index c283a81..9629703 100644
--- a/sensorhal/hubconnection.cpp
+++ b/sensorhal/hubconnection.cpp
@@ -1414,26 +1414,34 @@
             if (isActivitySensor(sensor) && mActivityEventHandler != NULL) {
                 mActivityEventHandler->OnFlush();
             } else {
-                struct Flush& flush = mFlushesPending[primary].front();
-                memset(&ev, 0x00, sizeof(sensors_event_t));
-                ev.version = META_DATA_VERSION;
-                ev.timestamp = 0;
-                ev.type = SENSOR_TYPE_META_DATA;
-                ev.sensor = 0;
-                ev.meta_data.what = META_DATA_FLUSH_COMPLETE;
-                ev.meta_data.sensor = flush.handle;
+                bool internal = false;
 
-                if (flush.internal) {
-                    if (flush.handle == COMMS_SENSOR_ACCEL_WRIST_AWARE)
-                        mLefty.accel = !mLefty.accel;
-                    else if (flush.handle == COMMS_SENSOR_GYRO_WRIST_AWARE)
-                        mLefty.gyro = !mLefty.gyro;
-                } else
+                {
+                    Mutex::Autolock autoLock(mLock);
+                    struct Flush& flush = mFlushesPending[primary].front();
+                    memset(&ev, 0x00, sizeof(sensors_event_t));
+                    ev.version = META_DATA_VERSION;
+                    ev.timestamp = 0;
+                    ev.type = SENSOR_TYPE_META_DATA;
+                    ev.sensor = 0;
+                    ev.meta_data.what = META_DATA_FLUSH_COMPLETE;
+                    ev.meta_data.sensor = flush.handle;
+
+                    if (flush.internal) {
+                        internal = true;
+                        if (flush.handle == COMMS_SENSOR_ACCEL_WRIST_AWARE)
+                            mLefty.accel = !mLefty.accel;
+                        else if (flush.handle == COMMS_SENSOR_GYRO_WRIST_AWARE)
+                            mLefty.gyro = !mLefty.gyro;
+                    }
+
+                    if (--flush.count == 0)
+                        mFlushesPending[primary].pop_front();
+                }
+
+                if (!internal)
                     write(&ev, 1);
 
-                if (--flush.count == 0)
-                    mFlushesPending[primary].pop_front();
-
                 ALOGV("flushing %d", ev.meta_data.sensor);
             }
         }