commit f4c81378d00d07f36aa1de8818fe7a5c7320e8ee
author Frankie Chang <frankie.chang@mediatek.com> Tue May 18 13:08:05 2021 +0800
committer Steven Moreland <smoreland@google.com> Wed May 19 18:27:05 2021 +0000
tree cdd6999299cfb0d787efe992698141335dd8440b
parent 33fd596d5449bb9fb1dfc9bbaf53fdee1b129ba4

ANDROID: binder: prevent double flushing when free buffer

Change-Id: I959ea32145a530f49288cc84b5ce27808937ff2e
Bug: 188512748

libs/binder/IPCThreadState.cpp

diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index d2919e7..e933f7e 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -516,14 +516,16 @@
 
 bool IPCThreadState::flushIfNeeded()
 {
-    if (mIsLooper || mServingStackPointer != nullptr) {
+    if (mIsLooper || mServingStackPointer != nullptr || mIsFlushing) {
         return false;
     }
+    mIsFlushing = true;
     // In case this thread is not a looper and is not currently serving a binder transaction,
     // there's no guarantee that this thread will call back into the kernel driver any time
     // soon. Therefore, flush pending commands such as BC_FREE_BUFFER, to prevent them from getting
     // stuck in this thread's out buffer.
     flushCommands();
+    mIsFlushing = false;
     return true;
 }
 
@@ -880,6 +882,7 @@
         mWorkSource(kUnsetWorkSource),
         mPropagateWorkSource(false),
         mIsLooper(false),
+        mIsFlushing(false),
         mStrictModePolicy(0),
         mLastTransactionBinderFlags(0),
         mCallRestriction(mProcess->mCallRestriction) {