Fix below use after free issues:
==4947==ERROR: AddressSanitizer: heap-use-after-free on address
0xec61f434 at pc 0xf1954c18 bp 0xed3ff6f0 sp 0xed3ff6e8
READ of size 4 at 0xec61f434 thread T12 (C3Dev-1-ReqQueu)
#0 0xf1954c17 in _ZN7android7camera313Camera3Stream23removeOutstandingBufferERK21camera3_stream_buffer
frameworks/av/services/camera/libcameraservice/device3/Camera3Stream.cpp:508
#1 0xf1954c17 in _ZN7android7camera313Camera3Stream12returnBufferERK21camera3_stream_bufferx
frameworks/av/services/camera/libcameraservice/device3/Camera3Stream.cpp:543
#2 0xf193c663 in _ZN7android13Camera3Device13RequestThread21cleanUpFailedRequestsEb
frameworks/av/services/camera/libcameraservice/device3/Camera3Device.cpp:4131
#3 0xf193db5b in _ZN7android13Camera3Device13RequestThread10threadLoopEv
frameworks/av/services/camera/libcameraservice/device3/Camera3Device.cpp:3854
#4 0xf1562f35 in _ZN7android6Thread11_threadLoopEPv system/core/libutils/Threads.cpp:747
#5 0xf0ee6947 in _ZL15__pthread_startPv bionic/libc/bionic/pthread_create.cpp:214
#6 0xf0eba381 in __start_thread bionic/libc/bionic/clone.cpp:47
0xec61f434 is located 68 bytes inside of 136-byte region [0xec61f3f0,0xec61f478)
freed by thread T0 here:
#7 0xf1a64963 in _ZdlPvSt11align_val_tRKSt9nothrow_t [asan_rtl]
#8 0xf155df09 in _ZNK7android7RefBase9decStrongEPKv system/core/libutils/RefBase.cpp:435
#9 0xf19693ab in _ZN7android7camera319Camera3OutputStream22BufferReleasedListener16onBufferReleasedEv
frameworks/av/services/camera/libcameraservice/device3/Camera3OutputStream.cpp:720
#3 0x1ff56dfb (<unknown module>)
Bug: 62218367
Change-Id: Ib03415f73a1e3c283520af752904b1bcc40bff28
Make sure the callback object won't be freed in the middle
of callback execution.
Test: CTS + stress test
Bug: 63683767
Change-Id: I6fb1b754cadb3d499c1c246687d2f60d444d00bb
This namespace is not used by this file and its declaration is removed
in a separate CL from utils/Log.h, which is the only place it is
defined, so we must remove this extraneous line.
Also, since that separate CL is deprecating utils/Log.h in favor of
log/log.h, we make the switch to the new header.
Test: Build
Exempt-From-Owner-Approval: Owners file needs updating
Change-Id: I34aa80765d30c79f8cb67eaf95a9995066bd672e
Calls flushTsSeries when a state change was detected
to avoid logging idle audio time as a buffer period.
Test: dumpsys media.log
Change-Id: Ia33bec8829dcd5d2de5c40f904e5ea19c5a2b453
Implement correct indication of client UID and PID to audio flinger
for AAudio MMAP streams in both exclusive mode and shared mode.
- Add start/stop client methods on MMAP streams used only when the MMAP
stream is in AAudio service and carries a mix of shared streams.
- Add "In Service'" indication from "client" side to AAudioServiceStreamMMAP
so that the behavior can be adapted accordingly.
- Modify logic on audio flinger side with regard to mmap tracks and
audio HAL stream activity:
- use same audio session for all clients on a same stream to match
audio policy logic to share same direct output stream for clients on same
session. This is also more consistent with current volume and effect
handling as all MMAP clients sharing the same output stream have the
same volume and use case.
- start/stop the HAL when the stream is started/stopped with the initial client
handle (returned when the stream is opened) but do not create a track.
AAudioService implementation will always send an additional start command before
first client starts and a stop command after last client stops,
in both shared and exclusive mode.
- start/stop a track only if the start/stop stream command is received
with a handle different from the initial handle.
- Allow more than one active client from the same UID on a MMAP input in audio policy.
Bug: 62950008
Test: verify playback and capture in mmap mode
Merged-In: I86151bbb637ff172d2fd5f813056eab13a7bcd3c
Change-Id: I86151bbb637ff172d2fd5f813056eab13a7bcd3c
Without a 'return', the code attempts to call a method on
a null thread instance.
Bug: 62918718
Test: doesn't crash when bogus audio_io_handle passed to 'getParameters'
Change-Id: I356dfd9531e0de41d869b8e29909dee5843dc795
Implement correct indication of client UID and PID to audio flinger
for AAudio MMAP streams in both exclusive mode and shared mode.
- Add start/stop client methods on MMAP streams used only when the MMAP
stream is in AAudio service and carries a mix of shared streams.
- Add "In Service'" indication from "client" side to AAudioServiceStreamMMAP
so that the behavior can be adapted accordingly.
- Modify logic on audio flinger side with regard to mmap tracks and
audio HAL stream activity:
- use same audio session for all clients on a same stream to match
audio policy logic to share same direct output stream for clients on same
session. This is also more consistent with current volume and effect
handling as all MMAP clients sharing the same output stream have the
same volume and use case.
- start/stop the HAL when the stream is started/stopped with the initial client
handle (returned when the stream is opened) but do not create a track.
AAudioService implementation will always send an additional start command before
first client starts and a stop command after last client stops,
in both shared and exclusive mode.
- start/stop a track only if the start/stop stream command is received
with a handle different from the initial handle.
- Allow more than one active client from the same UID on a MMAP input in audio policy.
Bug: 62950008
Test: verify playback and capture in mmap mode
Change-Id: I86151bbb637ff172d2fd5f813056eab13a7bcd3c
Block effect commands reserved for framework use when
received on server side IAudioEffect. Applications have no reason
to use these commands and they present a unnecessary attack surface.
Bug: 62019992
Test: run CTS tests for audio effects
Change-Id: Ie680d5d5650f99dbabf93891703e1cde2c2e852d
- Remove hand-written ICameraServiceProxy C++ impl; use the AIDL-
generated version instead
- Send client package name and camera facing with the camera state
notices
Test: Verify by logging that information sent to proxy is correct;
no camera CTS regressions.
Bug: 32449509
Change-Id: I7a305b76b4f1d5c08b7938108bd73c95986508e0
Only load removable digital device properties from streams
with dynamic profiles. This avoids aggregating properties from
other stream profiles when the device can also be reached via those
profiles.
Bug: 38423100
Test: connect various USB devices and check properties are loaded
properly.
Change-Id: Ie5eed397d3a475848a3d423d18ffae9d55917ac4
For treble, files shared between vendor and system must have a schema.
As .conf did not support such feature, transition to an xml based
configuration file.
This new format has several changes:
- library path are now relative to the standard effect directories
- effect parameters are no longer supported (nobody used them)
Test: Check that the dumpsys is similar than with the legacy formal
Bug: 37492580
Change-Id: Ie6bd84ed88124991600fa238cc13714874eefad9
Signed-off-by: Kevin Rocard <krocard@google.com>
Was calling close(), which is abstract and virtual.
This may have been related to some audioserver crashes.
Also cleaned up some strong pointer handling.
Bug: 63390734
Bug: 63353455
Test: run CTS nativemedia/aaudio many times
Change-Id: Ib95aed60a64771b64395c67f0921c67146f9d10f
Allow exclusive MMAP mode only if the HAL indicates
that the FD returned for shared memory buffer can be shared
with any application.
NOTE: the way the HAL indicates this is temporary until the audio
HAL is modified in next HIDL release.
Bug: 37167970
Test: check playback and capture in mmap exclusive and shared mode
Change-Id: I09c1461b2f99532ded2ef9d36d483b82096fda68
Add more information about various streams and endpoints.
Bug: 38396780
Test: adb shell dumpsys media.aaudio
Change-Id: I5cc116574bfc3aa93703c182d933dbdfcbefad7a
Testing the new max streams restriction revealed the bug
involving the second shared stream.
Bug: 62951298
Bug: 63171495
Test: test_n_streams.cpp can open MAX_STREAMS_PER_PROCESS MMAP streams
Change-Id: Ibea7d9c4716326a37c669954b52f397ed2968caa
It will be called, for example, when switching from speaker to Bluetooth.
Bug: 62883778
Test: run a long app and switch to or from Bluetooth
Change-Id: Iafb9b52d85c30fee71de46abfb99a27a1daabf59
When notifications are played, the audio policy checks if media
is playing for deciding which devices will play it. In the
absence of media, the notification is duplicated on speaker
and headset. With media playing, the notification routing
is set to that of the media strategy.
The bug is observed during A11y playback on headset with a
notification playing: A11y is playing on headset, but the
device can't play the notification on speaker + headset at
the same time, resulting in the notification playing in and
out based on the A11y playback in headset.
The fix is to also consider A11y activity when routing
notification playback (under STRATEGY_SONIFICATION_RESPECTFUL).
This improves the UX the notification is not missed, and
doesn't cut in and out.
Test: play Talkback on headset, receive notification at the same time.
Bug: 62907561
Change-Id: Ib924ec41cb7e16d6f2686d8615facba08e256ade
A new Client stream in shared mode can share an existing endpoint
if it has no preferences or compatible device, sample rate and channel
count requests.
Bug: 62961537
Test: play and capture with AAudio in mmap mode
Change-Id: I38536fb486dfc06f4399f7d02248384583fd3a17
Was using the wrong pid.
Bug: 38267698
Test: run an aaudio example like write_sine.cpp and control-C in the middle
Change-Id: I8819fcdd78354554b926d8b8a59efa1a81fed110
Notify client when audio service dies. Clear connection.
Notify AAudio service when client dies. Close client streams.
Use sp<> to track ServiceStreams.
Bug: 38267698
Test: test_no_close.cpp
Change-Id: I5f1699ed3b8b7bd960947c0028a89ca8419ce7a0
When abortCaptures is called, the request queue is cleared; as part of that,
any requests with input buffers trigger the removal and return of one input
buffer from the input stream.
However, if the HAL currently is processing some number of reprocess
requests, the stream's max buffer limit may have been reached, in
which case getInputBuffer will block until the HAL returns an input
buffer. This stalls flushing (and calling of capture_request) for
some time, and seems to cause problems for the HAL during the flush.
So instead, don't respect the HAL's max buffer limit when all we're
doing is throwing work away.
Test: CTS, manual testing
Bug: 62420820
Change-Id: I72d8cdaf67fb3cc6876a03cee9e0021d95cecdfe
Request thread may race with disconnect call when device is
disconnected in error condition. Acquire mLock when camera
device is updating status tracker to prevent that race
(status tracker being freed and then updated).
In other places where status tracker is updated, there is
a promoted sp to guarantee status tracker remain alive during
the call.
Test: CTS, manual camera testing
Bug: 62420820
Change-Id: Id894b5d3482c64125c114f79dbe746c56048fcbe
If the sound trigger hal indicates that concurrent_capture is true, the
stream should not be preempted when when another sound trigger stream is
opened.
Test: Verify that multiple streams are not closed when triggered by
different engines.
Bug: 35956563
Change-Id: I3d5df136403e47fcc1280f63b25216f326b74d6f
When camera HAL dies and cameraserver is still alive, make sure
we update camera status after HAL re-register itself.
Test: kill hal process and run camera app, CTS
Bug: 63058983
Change-Id: Iba7e6cbebb674994c905f7feb1776acc479b612f
When changing stream volume, compare given device and current device
for stream both as filtered through Volume::getDeviceForVolume.
This behavior matters for Android devices playing notifications and
ringtones on the AUDIO_DEVICE_OUT_SPEAKER_SAFE, which is filtered
out for volumes (see Volume.h for getDeviceForVolume() method).
Test: play a ringtone and modify volume with vol keys
Bug: 63004956
Change-Id: I139099f34e0ab091fd0ea761c75949656549f77a
Turning audio on and off does not cause this event to be
written to the buffer. Now, a call to dumpsys media.log
simply writes to console an analysis of the data in memory,
and does not delete it afterwards.
Test: dumpsys media.log
Change-Id: Ie75fb27ec4050fb3891635f4c7933196cfd03643
Bug: 62090113
Test: run AAudio test and verify a valid device is reported just
after opening playback or capture streams in legacy mode.
Merged-In: Ic8be42e1735690eb00c811ef0cb8b5abb36172d6
Change-Id: Ic8be42e1735690eb00c811ef0cb8b5abb36172d6
There is only one function declared in that header file, and it is
mono_blend, so a more specific filename may be easier to understand.
Test: compiles OK
Merged-In: Ie2aec6c706b1822581b34d3702818b8200a1db8a
Change-Id: Ie2aec6c706b1822581b34d3702818b8200a1db8a
(cherry picked from commit 6bf707f4c0)
Note, filed b/62923763 to cleanup xmlparser includes.
Bug: 37343418
Test: builds with BOARD_VNDK_VERSION=current
Test: (sanity) YouTube on a device
Test: (sanity) Camera on a device
Test: (sanity) watch (part of a) movie on a device
Test: (sanity) YouTube on marlin
Test: (sanity) Camera on marlin
Test: (sanity) watch (part of a) movie on marlin
Test: (sanity) YouTube on angler
Test: (sanity) Camera on angler
Test: (sanity) watch (part of a) movie on angler
Change-Id: I461f999122da56cabb9d4d15b182899ced3b0120
Bug: 62090113
Test: run AAudio test and verify a valid device is reported just
after opening playback or capture streams in legacy mode.
Change-Id: Ic8be42e1735690eb00c811ef0cb8b5abb36172d6
Improve calculation of buffer capacity based on requested minimum.
Adjust timing of start() to reduce underflows.
Track ServiceEndpoints based on requested deviceId.
Fix getFramesRead() and flush() behavior.
Fix timeouts due to ClockModel lateness bug.
Misc cleanup.
Bug: 37755299
Test: test_aaudio.cpp
Change-Id: I637c16e87fbe14b6f28c60aeea0b9dfed965ecd0
Make AudioStreamInternal derive from PlayerBase to
provide playback and volume control via IPlayer interface.
Bug: 62027849
Test: verify aaudio playback in MMAP mode and registration of aaudio
players in AudioService when active
Change-Id: Ia0878d46637c0a954d8a6259868a2d3bccf19119
Set flag to select VOIP_TX input profile if input source
is VOICE_COMMUNICATION and phone state is MODE_IN_COMMUNICATION
Bug: 62495679
Test: Hangout call
Change-Id: I3b1bb9fbcdd5687ebb002facf0684983333e9a53
Pass uid of recording session along with other existing information
in the recording monitoring callback.
Define new structure, record_client_info, to group uid (new),
session id (existing) and source (existing) and simplify
method signatures and marshalling code.
Test: run cts -m CtsMediaTestCases -t android.media.cts.AudioRecordingConfigurationTest#testAudioManagerGetActiveRecordConfigurations
Bug 62579636
Change-Id: I18f66d7e55640a21f31021416a12a3e8094c3690
Eric Laurent
Shuzhen Wang
Yin-Chia Yeh
jiabin
TreeHugger Robot
Tom Cherry
Eino-Ville Talvala
Sanna Catherine de Treville Wager
Mikhail Naganov
Kevin Rocard
Phil Burk
Andy Hung
Jean-Michel Trivi
Chris Thornton
Tomasz Wasilczyk
Steven Moreland
Glenn Kasten
Chong Zhang
Haynes Mathew George