commit ebbb82365172337c6c250c6cac4e326970a9e351
author Eric Laurent <elaurent@google.com> Thu Dec 03 18:52:10 2015 -0800
committer Eric Laurent <elaurent@google.com> Wed Dec 09 19:03:53 2015 +0000
tree ce4c14da5f30a70caf006c25fdcdccb3fa9e82db
parent 7106b08ee43b84978e370b9c25e89f1ed7bfbf0d

post proc : volume listener : fix effect release crash

Fix access to deleted effect context in vol_prc_lib_release()

Bug: 25753245.
Change-Id: I64ca99e4d5d09667be4c8c605f66700b9ae67949
(cherry picked from commit 93ab6fdda7b7557ccb34372670c30fa6178f8426)

post_proc/volume_listener.c

diff --git a/post_proc/volume_listener.c b/post_proc/volume_listener.c
index cf15f1c..280bfe3 100644
--- a/post_proc/volume_listener.c
+++ b/post_proc/volume_listener.c
@@ -667,20 +667,31 @@
     struct listnode *node, *temp_node_next;
     vol_listener_context_t *context = NULL;
     vol_listener_context_t *recv_contex = (vol_listener_context_t *)handle;
-    int status = -1;
+    int status = -EINVAL;
     bool recompute_flag = false;
     int active_stream_count = 0;
+    uint32_t session_id;
+    uint32_t stream_type;
+    effect_uuid_t uuid;
+
     ALOGV("%s context %p", __func__, handle);
+
+    if (recv_contex == NULL) {
+        return status;
+    }
     pthread_mutex_lock(&vol_listner_init_lock);
+    session_id = recv_contex->session_id;
+    stream_type = recv_contex->stream_type;
+    uuid = recv_contex->desc->uuid;
 
     // check if the handle/context provided is valid
     list_for_each_safe(node, temp_node_next, &vol_effect_list) {
         context = node_to_item(node, struct vol_listener_context_s, effect_list_node);
-        if ((memcmp(&(context->desc->uuid), &(recv_contex->desc->uuid), sizeof(effect_uuid_t)) == 0)
-            && (context->session_id == recv_contex->session_id)
-            && (context->stream_type == recv_contex->stream_type)) {
+        if ((memcmp(&(context->desc->uuid), &uuid, sizeof(effect_uuid_t)) == 0)
+            && (context->session_id == session_id)
+            && (context->stream_type == stream_type)) {
             ALOGV("--- Found something to remove ---");
-            list_remove(&context->effect_list_node);
+            list_remove(node);
             PRINT_STREAM_TYPE(context->stream_type);
             if (context->dev_id && AUDIO_DEVICE_OUT_SPEAKER) {
                 recompute_flag = true;
@@ -694,6 +705,8 @@
 
     if (status != 0) {
         ALOGE("something wrong ... <<<--- Found NOTHING to remove ... ???? --->>>>>");
+        pthread_mutex_unlock(&vol_listner_init_lock);
+        return status;
     }
 
     // if there are no active streams, reset cal and volume level