Merge "audio service: fix regression in startBluetoothSco" into jb-mr2-dev
diff --git a/media/java/android/media/AudioService.java b/media/java/android/media/AudioService.java
index 882a635..f0a5c28 100644
--- a/media/java/android/media/AudioService.java
+++ b/media/java/android/media/AudioService.java
@@ -1948,8 +1948,13 @@
                 !mBootCompleted) {
             return;
         }
-        final long ident = Binder.clearCallingIdentity();
         ScoClient client = getScoClient(cb, true);
+        // The calling identity must be cleared before calling ScoClient.incCount().
+        // inCount() calls requestScoState() which in turn can call BluetoothHeadset APIs
+        // and this must be done on behalf of system server to make sure permissions are granted.
+        // The caller identity must be cleared after getScoClient() because it is needed if a new
+        // client is created.
+        final long ident = Binder.clearCallingIdentity();
         client.incCount();
         Binder.restoreCallingIdentity(ident);
     }
@@ -1960,8 +1965,11 @@
                 !mBootCompleted) {
             return;
         }
-        final long ident = Binder.clearCallingIdentity();
         ScoClient client = getScoClient(cb, false);
+        // The calling identity must be cleared before calling ScoClient.decCount().
+        // decCount() calls requestScoState() which in turn can call BluetoothHeadset APIs
+        // and this must be done on behalf of system server to make sure permissions are granted.
+        final long ident = Binder.clearCallingIdentity();
         if (client != null) {
             client.decCount();
         }