Free data queue before closing data file descriptor.
When data file descriptor is closed, the raw pointer mapped from the
file descriptor is invalidated. In that case, the data queue should be
freed so that it won't access the invalid address.
Bug: 314872581
Test: manually
Change-Id: Ida375e14cc3f9d85d434e45e539c8cff3125f992
diff --git a/media/libaaudio/src/binding/AudioEndpointParcelable.h b/media/libaaudio/src/binding/AudioEndpointParcelable.h
index 722dd14..12cc42e 100644
--- a/media/libaaudio/src/binding/AudioEndpointParcelable.h
+++ b/media/libaaudio/src/binding/AudioEndpointParcelable.h
@@ -53,7 +53,7 @@
int32_t addFileDescriptor(const android::base::unique_fd& fd, int32_t sizeInBytes);
/**
- * Close current data file descriptor. The duplicated file descriptor will be close.
+ * Close current data file descriptor. The duplicated file descriptor will be closed.
*/
void closeDataFileDescriptor();
diff --git a/media/libaaudio/src/client/AudioEndpoint.h b/media/libaaudio/src/client/AudioEndpoint.h
index 2c23e1d..b117572 100644
--- a/media/libaaudio/src/client/AudioEndpoint.h
+++ b/media/libaaudio/src/client/AudioEndpoint.h
@@ -107,7 +107,7 @@
*/
void eraseDataMemory();
- void freeDataQueue();
+ void freeDataQueue() { mDataQueue.reset(); }
void dump() const;
diff --git a/media/libaaudio/src/client/AudioStreamInternal.cpp b/media/libaaudio/src/client/AudioStreamInternal.cpp
index f431da8..52925d9 100644
--- a/media/libaaudio/src/client/AudioStreamInternal.cpp
+++ b/media/libaaudio/src/client/AudioStreamInternal.cpp
@@ -399,6 +399,12 @@
uint8_t buffer[getDeviceBufferCapacity() * getBytesPerFrame()];
android::fifo_frames_t fullFramesAvailable = mAudioEndpoint->read(buffer,
getDeviceBufferCapacity());
+ // Before releasing the data queue, update the frames read and written.
+ getFramesRead();
+ getFramesWritten();
+ // Call freeDataQueue() here because the following call to
+ // closeDataFileDescriptor() will invalidate the pointers used by the data queue.
+ mAudioEndpoint->freeDataQueue();
mEndPointParcelable.closeDataFileDescriptor();
aaudio_result_t result = mServiceInterface.exitStandby(
mServiceStreamHandleInfo, endpointParcelable);
diff --git a/media/libaaudio/src/client/AudioStreamInternalCapture.cpp b/media/libaaudio/src/client/AudioStreamInternalCapture.cpp
index d9b75da..faa320d 100644
--- a/media/libaaudio/src/client/AudioStreamInternalCapture.cpp
+++ b/media/libaaudio/src/client/AudioStreamInternalCapture.cpp
@@ -273,7 +273,8 @@
int64_t AudioStreamInternalCapture::getFramesRead() {
if (mAudioEndpoint) {
- mLastFramesRead = mAudioEndpoint->getDataReadCounter() + mFramesOffsetFromService;
+ mLastFramesRead = std::max(mLastFramesRead,
+ mAudioEndpoint->getDataReadCounter() + mFramesOffsetFromService);
}
return mLastFramesRead;
}
diff --git a/media/libaaudio/src/client/AudioStreamInternalPlay.cpp b/media/libaaudio/src/client/AudioStreamInternalPlay.cpp
index 3badb0b..366db31 100644
--- a/media/libaaudio/src/client/AudioStreamInternalPlay.cpp
+++ b/media/libaaudio/src/client/AudioStreamInternalPlay.cpp
@@ -329,8 +329,9 @@
int64_t AudioStreamInternalPlay::getFramesWritten() {
if (mAudioEndpoint) {
- mLastFramesWritten = mAudioEndpoint->getDataWriteCounter()
- + mFramesOffsetFromService;
+ mLastFramesWritten = std::max(
+ mLastFramesWritten,
+ mAudioEndpoint->getDataWriteCounter() + mFramesOffsetFromService);
}
return mLastFramesWritten;
}