commit 24d32f5a98296833756b0aba26831c9ba1d546c0
author an.xi <an.xi@amlogic.com> Thu Dec 26 16:50:23 2019 +0800
committer jie.yuan <jie.yuan@amlogic.com> Wed Dec 02 19:10:37 2020 +0800
tree 7358d4cea1179bbb8cc22f0e56f1aca01c3a1da4
parent 009957812466ee6615a55ff0d657a270d90cadb8

SystemServer: fix an infinite loop in TvInputManagerService [1/1]

PD#SWPL-6385
Bug:174639896

Problem:
There could be an infinite loop when TvInputManagerService processes
a DeathRecipient's callback and fails to remove its session

Solution:
Do the clear work to make sure the related session is removed finally

Verify:
verify it on Marconi

Change-Id: I9bd79fbc49b8283691870f1e745b324d1322b292
Signed-off-by: an.xi <an.xi@amlogic.com>

services/core/java/com/android/server/tv/TvInputManagerService.java

diff --git a/services/core/java/com/android/server/tv/TvInputManagerService.java b/services/core/java/com/android/server/tv/TvInputManagerService.java
index 323ac7b..bedcf9c 100755
--- a/services/core/java/com/android/server/tv/TvInputManagerService.java
+++ b/services/core/java/com/android/server/tv/TvInputManagerService.java
@@ -714,6 +714,7 @@
         SessionState sessionState = userState.sessionStateMap.remove(sessionToken);
 
         if (sessionState == null) {
+            Slog.e(TAG, "sessionState null, no more remove session action!");
             return;
         }
 
@@ -2278,8 +2279,16 @@
                 ClientState clientState = userState.clientStateMap.get(clientToken);
                 if (clientState != null) {
                     while (clientState.sessionTokens.size() > 0) {
+                        IBinder sessionToken = clientState.sessionTokens.get(0);
                         releaseSessionLocked(
-                                clientState.sessionTokens.get(0), Process.SYSTEM_UID, userId);
+                                sessionToken, Process.SYSTEM_UID, userId);
+                        // the releaseSessionLocked function may return before the sessionToken
+                        // is removed if the related sessionState is null. So need to check again
+                        // to avoid death curculation.
+                        if (clientState.sessionTokens.contains(sessionToken)) {
+                            Slog.d(TAG, "remove sessionToken " + sessionToken + " for " + clientToken);
+                            clientState.sessionTokens.remove(sessionToken);
+                        }
                     }
                 }
                 clientToken = null;