commit 91812147804d733f6de769cab860f419d394a3ea
author Venkata Narendra Kumar Gutta <vgutta@codeaurora.org> Mon Aug 11 18:20:49 2014 +0530
committer Venkata Narendra Kumar Gutta <vgutta@codeaurora.org> Mon Aug 11 18:23:19 2014 +0530
tree 8db3bc95ce7b95e8128c58b478e44e3d42b06752
parent 2e52c5740e6a2331ce221f3559452c4bbdc04282

hal: Avoid double free while closing of VoIP driver

There is a double free happening while closing of VoIP
driver using passthrough apk. There is no protection of
VoIP node during close of  VoIP driver. Add protection
to avoid double free of VoIP node.

Change-Id: I54c2a6aec525590e3e6782d356168f8fe8dc86b0

hal/audio_hw.c

diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index d8c48b9..9171d04 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -1779,7 +1779,9 @@
         if (out->pcm)
             ALOGE("%s: error %d - %s", __func__, ret, pcm_get_error(out->pcm));
         if (out->usecase == USECASE_COMPRESS_VOIP_CALL) {
+            pthread_mutex_lock(&adev->lock);
             voice_extn_compress_voip_close_output_stream(&out->stream.common);
+            pthread_mutex_unlock(&adev->lock);
             out->standby = true;
         }
         out_standby(&out->stream.common);
@@ -2189,7 +2191,9 @@
 
     if (ret != 0) {
         if (in->usecase == USECASE_COMPRESS_VOIP_CALL) {
+            pthread_mutex_lock(&adev->lock);
             voice_extn_compress_voip_close_input_stream(&in->stream.common);
+            pthread_mutex_unlock(&adev->lock);
             in->standby = true;
         }
         in_standby(&in->stream.common);
@@ -2506,7 +2510,9 @@
     ALOGD("%s: enter:stream_handle(%p)",__func__, out);
 
     if (out->usecase == USECASE_COMPRESS_VOIP_CALL) {
+        pthread_mutex_lock(&adev->lock);
         ret = voice_extn_compress_voip_close_output_stream(&stream->common);
+        pthread_mutex_unlock(&adev->lock);
         if(ret != 0)
             ALOGE("%s: Compress voip output cannot be closed, error:%d",
                   __func__, ret);
@@ -2845,10 +2851,14 @@
 {
     int ret;
     struct stream_in *in = (struct stream_in *)stream;
+    struct audio_device *adev = in->dev;
+
     ALOGD("%s: enter:stream_handle(%p)",__func__, in);
 
     if (in->usecase == USECASE_COMPRESS_VOIP_CALL) {
+        pthread_mutex_lock(&adev->lock);
         ret = voice_extn_compress_voip_close_input_stream(&stream->common);
+        pthread_mutex_unlock(&adev->lock);
         if (ret != 0)
             ALOGE("%s: Compress voip input cannot be closed, error:%d",
                   __func__, ret);