oboeservice: hold onto linked binder

Before, in Android 10, this would have been a small leak because
unlinkToDeath is not called, but now, objects are automatically
unlinked. However, this presents a problem since you must hold onto
a binder in order to linkToDeath. This now holds onto the binder
and is relying on the automatic-unlinkToDeath behavior.

Fixes: 145675653
Test: atest CtsNativeMediaAAudioTestCases
arm64-v8a CtsNativeMediaAAudioTestCases: Passed: 122, Failed: 0, Ignored: 0, Assumption Failed: 0
Test: after using app and killing which uses AAudio MMAP stream,
dumpsys output for media.aaudio is cleaned up:

------------ AAudio Service ------------
Stream Handles:
AAudioClientTracker:
AAudioEndpointManager:
Exclusive MMAP Endpoints: 0
 ExclusiveSearchCount:  3
 ExclusiveFoundCount:   0
 ExclusiveOpenCount:    1
 ExclusiveCloseCount:   1

Shared Endpoints: 0
 SharedSearchCount:     1
 SharedFoundCount:      0
 SharedOpenCount:       0
 SharedCloseCount:      0

Change-Id: I2ef141320dc3ef0135fb7ef002d85377d06a75c2

services/oboeservice/AAudioClientTracker.cpp

@@ -75,10 +75,10 @@ aaudio_result_t AAudioClientTracker::registerClient(pid_t pid,
 
     std::lock_guard<std::mutex> lock(mLock);
     if (mNotificationClients.count(pid) == 0) {
-        sp<NotificationClient> notificationClient = new NotificationClient(pid);
+        sp<IBinder> binder = IInterface::asBinder(client);
+        sp<NotificationClient> notificationClient = new NotificationClient(pid, binder);
         mNotificationClients[pid] = notificationClient;
 
-        sp<IBinder> binder = IInterface::asBinder(client);
         status_t status = binder->linkToDeath(notificationClient);
         ALOGW_IF(status != NO_ERROR, "registerClient() linkToDeath = %d\n", status);
         return AAudioConvert_androidToAAudioResult(status);
@@ -113,7 +113,7 @@ AAudioClientTracker::registerClientStream(pid_t pid, sp<AAudioServiceStreamBase>
     if (notificationClient == 0) {
         // This will get called the first time the audio server registers an internal stream.
         ALOGV("registerClientStream(%d,) unrecognized pid\n", pid);
-        notificationClient = new NotificationClient(pid);
+        notificationClient = new NotificationClient(pid, nullptr);
         mNotificationClients[pid] = notificationClient;
     }
     notificationClient->registerClientStream(serviceStream);
@@ -136,8 +136,8 @@ AAudioClientTracker::unregisterClientStream(pid_t pid,
     return AAUDIO_OK;
 }
 
-AAudioClientTracker::NotificationClient::NotificationClient(pid_t pid)
-        : mProcessId(pid) {
+AAudioClientTracker::NotificationClient::NotificationClient(pid_t pid, const sp<IBinder>& binder)
+        : mProcessId(pid), mBinder(binder) {
 }
 
 AAudioClientTracker::NotificationClient::~NotificationClient() {

services/oboeservice/AAudioClientTracker.h

@@ -73,7 +73,7 @@ private:
      */
     class NotificationClient : public IBinder::DeathRecipient {
     public:
-        NotificationClient(pid_t pid);
+        NotificationClient(pid_t pid, const android::sp<IBinder>& binder);
         virtual ~NotificationClient();
 
         int32_t getStreamCount();
@@ -91,6 +91,8 @@ private:
         mutable std::mutex                              mLock;
         const pid_t                                     mProcessId;
         std::set<android::sp<AAudioServiceStreamBase>>  mStreams;
+        // hold onto binder to receive death notifications
+        android::sp<IBinder>                            mBinder;
     };
 
     mutable std::mutex                               mLock;