commit 506fd42a89494c836eda69df354177affa0820f8
author Aniket Kumar Lata <alata@quicinc.com> Wed Oct 23 15:15:26 2019 -0700
committer Harrison Lingren <hlingren@google.com> Tue Nov 26 15:24:18 2019 -0800
tree 8bfe7ea441bccda633f4c8cfb434fdb080c7b495
parent 73d6b59977595c1d0a222a1656f298e7991e43b9

audio: free and assign NULL to global static device pointer

Free and assign NULL to global static device pointer instead of local
pointer to avoid free after use issue.

Bug: 144583303
Signed-off-by: Harrison Lingren <hlingren@google.com>

Change-Id: Idfdef719320efcd792c7d2ebd7ec2dfe5d3fbfbd

hal/audio_hw.c

diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index 1c99066..17bb6f6 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -6282,12 +6282,10 @@
 static int adev_close(hw_device_t *device)
 {
     size_t i;
-    struct audio_device *adev_temp = (struct audio_device *)device;
-
-    if (!adev_temp)
-        return 0;
 
     pthread_mutex_lock(&adev_init_lock);
+    if (!device || ((struct audio_device *)device != adev))
+        goto done;
 
     if ((--audio_device_ref_count) == 0) {
         audio_extn_snd_mon_unregister_listener(adev);
@@ -6306,10 +6304,11 @@
             adev->adm_deinit(adev->adm_data);
         pthread_mutex_destroy(&adev->lock);
         free(device);
+        adev = NULL;
     }
 
+done:
     pthread_mutex_unlock(&adev_init_lock);
-
     return 0;
 }