commit 3f0bcf0bc22688c5cffb3404fea7a56946bac4c0
author Myles Watson <mylesgw@google.com> Thu Mar 09 10:39:31 2017 -0800
committer gitbuildkicker <android-build@google.com> Thu Mar 09 14:27:07 2017 -0800
tree 9e48a1a2332519976eee0d414426449cdc90e678
parent 753d88b48f0a93181d50821f349e3e66591d2571

Bluetooth: Protect callbacks during shutdown

- Hold the mutex during callbacks
- Disable power mode before deleting hci_

Bug: 36084266
Test: Switch users repeatedly (toggles Bluetooth)
Change-Id: I7e4d405e9028c3363c112a8b09c03b8aea652b7a
(cherry picked from commit 9ef1f7198234078095abe14c13e654504f8f2cca)

bluetooth/1.0/default/async_fd_watcher.cc

diff --git a/bluetooth/1.0/default/async_fd_watcher.cc b/bluetooth/1.0/default/async_fd_watcher.cc
index 2f23a69..05ac537 100644
--- a/bluetooth/1.0/default/async_fd_watcher.cc
+++ b/bluetooth/1.0/default/async_fd_watcher.cc
@@ -159,19 +159,13 @@
     }
 
     // Invoke the data ready callbacks if appropriate.
-    std::vector<decltype(watched_fds_)::value_type> saved_callbacks;
     {
+      // Hold the mutex to make sure that the callbacks are still valid.
       std::unique_lock<std::mutex> guard(internal_mutex_);
       for (auto& it : watched_fds_) {
         if (FD_ISSET(it.first, &read_fds)) {
-          saved_callbacks.push_back(it);
-        }
-      }
-    }
-
-    for (auto& it : saved_callbacks) {
-      if (it.second) {
         it.second(it.first);
+        }
       }
     }
   }

bluetooth/1.0/default/vendor_interface.cc

diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index 6d3b56f..2576eca 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -268,6 +268,16 @@
 }
 
 void VendorInterface::Close() {
+  // These callbacks may send HCI events (vendor-dependent), so make sure to
+  // StopWatching the file descriptor after this.
+  if (lib_interface_ != nullptr) {
+    bt_vendor_lpm_mode_t mode = BT_VND_LPM_DISABLE;
+    lib_interface_->op(BT_VND_OP_LPM_SET_MODE, &mode);
+
+    int power_state = BT_VND_PWR_OFF;
+    lib_interface_->op(BT_VND_OP_POWER_CTRL, &power_state);
+  }
+
   fd_watcher_.StopWatchingFileDescriptors();
 
   if (hci_ != nullptr) {
@@ -276,12 +286,7 @@
   }
 
   if (lib_interface_ != nullptr) {
-    bt_vendor_lpm_mode_t mode = BT_VND_LPM_DISABLE;
-    lib_interface_->op(BT_VND_OP_LPM_SET_MODE, &mode);
-
     lib_interface_->op(BT_VND_OP_USERIAL_CLOSE, nullptr);
-    int power_state = BT_VND_PWR_OFF;
-    lib_interface_->op(BT_VND_OP_POWER_CTRL, &power_state);
   }
 
   if (lib_handle_ != nullptr) {