commit 2f1450150334bd78f15c08250af6732e2d39c9b0
author Mingbo Zhang <mingboz@codeaurora.org> Fri Mar 13 10:58:08 2020 +0800
committer Mingbo Zhang <mingboz@codeaurora.org> Wed Mar 25 04:37:39 2020 +0000
tree 3afc84f2d420ed6471342518ea1cd658b994fac1
parent 942216bbf863f4e38003ae1924d9e3160f214ae2

move storeActiveDeviceVolume out of BtA2dpLock scope in removeActiveDevice

Issue: btif thread is stuck and audio server crashed.

Analysis:
1) When disconnecting a2dp, setActiveDeviceInternal->removeActiveDevice
->storeVolumeForDevice->mAudioManager.getStreamVolume is invoked with
mBtA2dpLock acquired.
2) At the same time, a2dp is started by audio side, then
bta2dp_audio_state_callback->messageFromNative wants to acqurie
mBtA2dpLock. Because mBtA2dpLock is already acquired in 1), btif thread
is stuck and cannot respond a2dp started ack to audio side.
3) Because audio side cannot receive a2dp startd ack,
mAudioManager.getStreamVolume will never return, then deadlock happened.

Fix:
To fix it, move storeActiveDeviceVolume out of mBtA2dpLock scope in
removeActiveDevice to avoid mBtA2dpLock deadlock.

Change-Id: I83a0828f13731eaa0f9a484bdaa19d52b6759ec0
CRs-Fixed: 2638331

src/com/android/bluetooth/a2dp/A2dpService.java

diff --git a/src/com/android/bluetooth/a2dp/A2dpService.java b/src/com/android/bluetooth/a2dp/A2dpService.java
index b232568..2d2f34a 100755
--- a/src/com/android/bluetooth/a2dp/A2dpService.java
+++ b/src/com/android/bluetooth/a2dp/A2dpService.java
@@ -716,21 +716,27 @@
     }
 
     private void storeActiveDeviceVolume() {
-        // Make sure volume has been stored before been removed from active.
-        if (mFactory.getAvrcpTargetService() != null && mActiveDevice != null) {
-            mFactory.getAvrcpTargetService().storeVolumeForDevice(mActiveDevice);
+        BluetoothDevice activeDevice;
+        synchronized (mStateMachines) {
+            activeDevice = mActiveDevice;
         }
-        if (mActiveDevice != null && mAvrcp_ext != null) {
-            mAvrcp_ext.storeVolumeForDevice(mActiveDevice);
+        // Make sure volume has been stored before been removed from active.
+        if (mFactory.getAvrcpTargetService() != null && activeDevice != null) {
+            mFactory.getAvrcpTargetService().storeVolumeForDevice(activeDevice);
+        }
+        synchronized (mBtAvrcpLock) {
+            if (activeDevice != null && mAvrcp_ext != null) {
+                mAvrcp_ext.storeVolumeForDevice(activeDevice);
+            }
         }
     }
 
     private void removeActiveDevice(boolean forceStopPlayingAudio) {
         BluetoothDevice previousActiveDevice = mActiveDevice;
-        synchronized (mBtA2dpLock) {
-            // Make sure volume has been store before device been remove from active.
-            storeActiveDeviceVolume();
 
+        // Make sure volume has been store before device been remove from active.
+        storeActiveDeviceVolume();
+        synchronized (mBtA2dpLock) {
             // This needs to happen before we inform the audio manager that the device
             // disconnected. Please see comment in updateAndBroadcastActiveDevice() for why.
             updateAndBroadcastActiveDevice(null);