tree 2b33869ab55bd85fc7e55a3b46caace23eae7a93
parent 429804c700a0b0db72c2e8d239f75e9e105e3ebc
author Anthony Stange <stange@google.com> 1607549441 -0500
committer android-build-team Robot <android-build-team-robot@google.com> 1612833855 +0000

Use strong pointer in ALooper to avoid use-after-free

If the endpoint that has a reference to the ASensorEventQueue goes away
without calling ASensorManager_destroyEventQueue, then the event queue's
reference goes to 0. This causes the event queue to be destroyed, but
the looper may still call it since it hasn't been invalidated yet
causing a use-after-free.

To avoid this, store the event queue as a weak pointer in the looper's
queue and attempt to promote it to a strong pointer when it needs to be
used. If it can't be promoted, then it is ignored and cleared later.

Bug: 175074139
Test: Load Android firmware image and run the camera app to verify no
crashes are seen.

Merged-In: I1439bf9c0a725818889f7be64e234d952363f4db
Change-Id: I1439bf9c0a725818889f7be64e234d952363f4db
(cherry picked from commit 7d712cfe6ddf86c07c4f2baee74ec948c7fc72d0)