commit 0e1f56e2806875e130c719e46888523ac503726a
author lihong8 <lihong8@xiaomi.corp-partner.google.com> Thu Aug 25 11:15:33 2022 +0800
committer Eric Laurent <elaurent@google.com> Wed Aug 31 08:49:08 2022 +0000
tree a575511b13a28ae0712d48a0573204490d635f2f
parent d7c16f1f1227ca9afb5f21c885908207a4aa0271

[HWAsan Test]fix use-after-free bug

add mutex to synchronize data between threads to avoid accessing the released uid

Bug: 243728713
Signed-off-by: lihong8 <lihong8@xiaomi.corp-partner.google.com>
Change-Id: If5c3631bcea8424d6fb2667c7c45a826c81bf686

services/audiopolicy/service/AudioPolicyService.cpp

diff --git a/services/audiopolicy/service/AudioPolicyService.cpp b/services/audiopolicy/service/AudioPolicyService.cpp
index e7d945f..ce07dcd 100644
--- a/services/audiopolicy/service/AudioPolicyService.cpp
+++ b/services/audiopolicy/service/AudioPolicyService.cpp
@@ -1721,6 +1721,7 @@
 }
 
 bool AudioPolicyService::UidPolicy::isA11yOnTop() {
+    Mutex::Autolock _l(mLock);
     for (const auto &uid : mCachedUids) {
         if (!isA11yUid(uid.first)) {
             continue;

services/audiopolicy/service/AudioPolicyService.h

diff --git a/services/audiopolicy/service/AudioPolicyService.h b/services/audiopolicy/service/AudioPolicyService.h
index 3a08cf8..39218dd 100644
--- a/services/audiopolicy/service/AudioPolicyService.h
+++ b/services/audiopolicy/service/AudioPolicyService.h
@@ -475,8 +475,8 @@
         Mutex mLock;
         ActivityManager mAm;
         bool mObserverRegistered = false;
-        std::unordered_map<uid_t, std::pair<bool, int>> mOverrideUids;
-        std::unordered_map<uid_t, std::pair<bool, int>> mCachedUids;
+        std::unordered_map<uid_t, std::pair<bool, int>> mOverrideUids GUARDED_BY(mLock);
+        std::unordered_map<uid_t, std::pair<bool, int>> mCachedUids GUARDED_BY(mLock);
         std::vector<uid_t> mAssistantUids;
         std::vector<uid_t> mActiveAssistantUids;
         std::vector<uid_t> mA11yUids;