Fix dangling pointer when device closed just after opening.
Bug: 4088239
Change-Id: I210b918370357560a5ace8ea8dd7601255487e88
diff --git a/services/input/EventHub.cpp b/services/input/EventHub.cpp
index e2da740..853dda4 100644
--- a/services/input/EventHub.cpp
+++ b/services/input/EventHub.cpp
@@ -1074,8 +1074,34 @@
mDevices.removeAt(index);
device->close();
- device->next = mClosingDevices;
- mClosingDevices = device;
+ // Unlink for opening devices list if it is present.
+ Device* pred = NULL;
+ bool found = false;
+ for (Device* entry = mOpeningDevices; entry != NULL; ) {
+ if (entry == device) {
+ found = true;
+ break;
+ }
+ pred = entry;
+ entry = entry->next;
+ }
+ if (found) {
+ // Unlink the device from the opening devices list then delete it.
+ // We don't need to tell the client that the device was closed because
+ // it does not even know it was opened in the first place.
+ LOGI("Device %s was immediately closed after opening.", device->path.string());
+ if (pred) {
+ pred->next = device->next;
+ } else {
+ mOpeningDevices = device->next;
+ }
+ delete device;
+ } else {
+ // Link into closing devices list.
+ // The device will be deleted later after we have informed the client.
+ device->next = mClosingDevices;
+ mClosingDevices = device;
+ }
return 0;
}