commit b2ea3ccb7ed058a1db71b07bc1429d26bf4c3e37
author Aniket Kumar Lata <alata@quicinc.com> Mon Aug 26 15:38:11 2019 -0700
committer Carter Hsu <carterhsu@google.com> Mon Nov 25 07:22:09 2019 +0000
tree c1570648a03685ac986eb0d0a98d5bcc36a458c0
parent 73d6b59977595c1d0a222a1656f298e7991e43b9

post_proc: release vol listener object based on context

Releasing volume listener object based on session_id and
stream type is not accurate, which results into false free
and dangling pointer. Release volume listener object based
on context.

Bug: 123583662
Test: manual
Change-Id: I335d064059f1b3e951567af2a40f7a1177df169c

post_proc/volume_listener.c

diff --git a/post_proc/volume_listener.c b/post_proc/volume_listener.c
index ea26860..f356cff 100644
--- a/post_proc/volume_listener.c
+++ b/post_proc/volume_listener.c
@@ -764,9 +764,6 @@
     int status = -EINVAL;
     bool recompute_flag = false;
     int active_stream_count = 0;
-    uint32_t session_id;
-    uint32_t stream_type;
-    effect_uuid_t uuid;
 
     ALOGV("%s context %p", __func__, handle);
 
@@ -774,32 +771,20 @@
         return status;
     }
     pthread_mutex_lock(&vol_listner_init_lock);
-    session_id = recv_contex->session_id;
-    stream_type = recv_contex->stream_type;
-
-    if (recv_contex->desc == NULL) {
-        ALOGE("%s: Got NULL descriptor, session %u, stream type %u",
-                __func__, session_id, stream_type);
-        dump_list_l();
-        pthread_mutex_unlock(&vol_listner_init_lock);
-        return status;
-    }
-    uuid = recv_contex->desc->uuid;
 
     // check if the handle/context provided is valid
     list_for_each_safe(node, temp_node_next, &vol_effect_list) {
         context = node_to_item(node, struct vol_listener_context_s, effect_list_node);
-        if ((memcmp(&(context->desc->uuid), &uuid, sizeof(effect_uuid_t)) == 0)
-            && (context->session_id == session_id)
-            && (context->stream_type == stream_type)) {
+        if (context == recv_contex) {
             ALOGV("--- Found something to remove ---");
-            list_remove(node);
             PRINT_STREAM_TYPE(context->stream_type);
             if (valid_dev_in_context(context)) {
                 recompute_flag = true;
             }
+            list_remove(&context->effect_list_node);
             free(context);
             status = 0;
+            break;
         } else {
             ++active_stream_count;
         }