commit 4b589f6332c29c734a9f05d830eb162e6f9245d4
author Anthony Stange <stange@google.com> Mon May 04 15:13:26 2020 -0400
committer Anthony Stange <stange@google.com> Wed May 06 09:01:03 2020 -0400
tree cd2f22c504bbf7c77c98bbff2d0610a0983f970d
parent 91f552736c21cef57996e12f859e0cd25d85c306

Ensure looper isn't used after invalidateSensorQueue

looper->signalSensorEvents causes the sensor event queue to be
re-registered even if invalidateSensorQueue has already been called.
This can happen if events are still being sent through onEvent even
after invalidate() is invoked.

Ensure that invalidate() stops any further usage of the looper through
onEvent to avoid using freed data.

Bug: 132658096
Test: Verify VNDK can sample as normal
Change-Id: I7dfbf10776d9386433aa3c64667ba41fc45cb7cb

sensorservice/libsensorndkbridge/ASensorEventQueue.cpp

diff --git a/sensorservice/libsensorndkbridge/ASensorEventQueue.cpp b/sensorservice/libsensorndkbridge/ASensorEventQueue.cpp
index d109426..7eee89c 100644
--- a/sensorservice/libsensorndkbridge/ASensorEventQueue.cpp
+++ b/sensorservice/libsensorndkbridge/ASensorEventQueue.cpp
@@ -106,16 +106,12 @@
     LOG(VERBOSE) << "ASensorEventQueue::onEvent";
 
     if (static_cast<int32_t>(event.sensorType) != ASENSOR_TYPE_ADDITIONAL_INFO ||
-        mRequestAdditionalInfo.load()) {
-        {
-            Mutex::Autolock autoLock(mLock);
+            mRequestAdditionalInfo.load()) {
 
-            mQueue.emplace_back();
-            sensors_event_t* sensorEvent = &mQueue[mQueue.size() - 1];
-            android::hardware::sensors::V1_0::implementation::convertToSensorEvent(event,
-                                                                                   sensorEvent);
-        }
-
+        Mutex::Autolock autoLock(mLock);
+        mQueue.emplace_back();
+        sensors_event_t* sensorEvent = &mQueue[mQueue.size() - 1];
+        android::hardware::sensors::V1_0::implementation::convertToSensorEvent(event, sensorEvent);
         mLooper->signalSensorEvents(this);
     }
 
@@ -134,6 +130,7 @@
 }
 
 void ASensorEventQueue::invalidate() {
+    Mutex::Autolock autoLock(mLock);
     mLooper->invalidateSensorQueue(this);
     setImpl(nullptr);
 }