commit 6bed261e92359d636f47b0ef0538ef69a93b19fe
author qctecmdr <qctecmdr@localhost> Fri Apr 17 22:54:14 2020 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri Apr 17 22:54:14 2020 -0700
tree 1d902b3258cd117be461d5d3caa808ac353d5979
parent f6cc050e7da66d3f42a561f2ca3f1a87be72e86b
parent ad14a97019aa9cf04a3b74a63025d2a850b70966

Merge "st-hal: Fix use-after-free in clear_devices"

sound_trigger_hw.c

diff --git a/sound_trigger_hw.c b/sound_trigger_hw.c
index f677147..54d26d7 100644
--- a/sound_trigger_hw.c
+++ b/sound_trigger_hw.c
@@ -1246,8 +1246,8 @@
              platform_stdev_compare_device_type(&stdev->active_rx_dev_list,
                  AUDIO_DEVICE_OUT_SPEAKER) ||
              platform_stdev_compare_device_type(&stdev->active_rx_dev_list,
-                 AUDIO_DEVICE_IN_WIRED_HEADSET))) {
-
+                 AUDIO_DEVICE_IN_WIRED_HEADSET)) &&
+             stdev->session_allowed) {
             /* pause and resume ADSP sessions to send new echo reference */
             list_for_each(node, &stdev->sound_model_list) {
                 p_ses = node_to_item(node, st_session_t, list_node);

sound_trigger_platform.c

diff --git a/sound_trigger_platform.c b/sound_trigger_platform.c
index a031ff1..04abf2e 100644
--- a/sound_trigger_platform.c
+++ b/sound_trigger_platform.c
@@ -4669,7 +4669,7 @@
 {
     struct platform_data *my_data;
     sound_trigger_device_t *stdev;
-    bool concurrency_ses_allowed = false;
+    bool concurrency_ses_allowed = true;
 
     if (!platform) {
         ALOGE("%s: NULL platform", __func__);
@@ -4723,13 +4723,12 @@
         }
         if (event_type == AUDIO_EVENT_PLAYBACK_STREAM_ACTIVE ||
             event_type == AUDIO_EVENT_PLAYBACK_STREAM_INACTIVE) {
-            concurrency_ses_allowed = true;
             if (stdev->rx_concurrency_disabled &&
                 stdev->rx_concurrency_active > 0 &&
                 num_sessions > stdev->rx_conc_max_st_ses)
                 concurrency_ses_allowed = false;
-        } else if (stdev->conc_capture_supported) {
-            concurrency_ses_allowed = true;
+        }
+        if (concurrency_ses_allowed && stdev->conc_capture_supported) {
             if ((!stdev->conc_voice_call_supported && stdev->conc_voice_active) ||
                 (!stdev->conc_voip_call_supported && stdev->conc_voip_active))
                 concurrency_ses_allowed = false;
@@ -4757,8 +4756,8 @@
         }
         if (stdev->conc_capture_supported)
             concurrency_ses_allowed = stdev->session_allowed;
-        else if (stdev->tx_concurrency_active == 0)
-            concurrency_ses_allowed = true;
+        else if (stdev->tx_concurrency_active > 0)
+            concurrency_ses_allowed = false;
     }
 
     /*
@@ -5692,10 +5691,12 @@
     if (is_ec_profile(profile_type)) {
         event_info.st_ec_ref_enabled = enable;
         // reset the pending active EC mixer ctls first
-        if (!stdev->audio_ec_enabled && stdev->ec_reset_pending_cnt > 0) {
-            while (stdev->ec_reset_pending_cnt--)
+        if (!stdev->audio_ec_enabled) {
+            while (stdev->ec_reset_pending_cnt > 0) {
                 audio_route_reset_and_update_path(stdev->audio_route,
                         my_data->ec_ref_mixer_path);
+                stdev->ec_reset_pending_cnt--;
+            }
         }
         if (enable) {
             stdev->audio_hal_cb(ST_EVENT_UPDATE_ECHO_REF, &event_info);