| commit | 1a886d4d0ba7aa77d04dc38a9a44ac355d99fb85 | [log] [tgz] |
|---|---|---|
| author | Bailey Forrest <bcf@google.com> | Wed Jun 07 14:55:37 2017 -0700 |
| committer | Pavlin Radoslavov <pavlin@google.com> | Wed Oct 25 00:58:17 2017 +0000 |
| tree | 344104d87b5f21ea5a4cfac86f39268d9d68e968 | |
| parent | 2eb03c2bdbe9796f3c78d549a0acfabeb225df9e [diff] |
Fix race conditions in a2dp sink - Use std::atomic for btif_a2dp_sink_state variable - Add a lock for other static members Explanation: - There's the main thread that things on this file should run on: btif_a2dp_sink_cb.worker_thread - External callers may call from any thread. - fixed_queue_t is a thread safe queue which uses locking. Many of the functions just append commands to cmd_msg_queue which are commands which are processed by btif_a2dp_sink_command_ready. Operations on this queue can be done without locking. The main bug is a TOCTOU bug on 'rx_audio_queue'. btif_a2dp_sink_avk_handle_timer preforms a fixed_queue_try_peek_first operation and modifies the pointer without dequing it. This causes a race when other operations cause a dequeue on rx_audio_queue. I have added locks on all functions which modify the static data except: - Helpers which are only called while locked - Functions which only modify cmd_msg_queue or access btif_a2dp_sink_state Bug: 35807779 Test: Test on device. Change-Id: I289e23213426dbc182ca4a3fca26bc5658299381
Just build AOSP - Fluoride is there by default.
Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0
mkdir ~/fluoride cd ~/fluoride git clone https://android.googlesource.com/platform/system/bt
Install dependencies (require sudo access):
cd ~/fluoride/bt build/install_deps.sh
Then fetch third party dependencies:
cd ~/fluoride/bt mkdir third_party cd third_party git clone https://github.com/google/googletest.git git clone https://android.googlesource.com/platform/external/aac git clone https://android.googlesource.com/platform/external/libchrome git clone https://android.googlesource.com/platform/external/libldac git clone https://android.googlesource.com/platform/external/modp_b64 git clone https://android.googlesource.com/platform/external/tinyxml2
And third party dependencies of third party dependencies:
cd fluoride/bt/third_party/libchrome/base/third_party mkdir valgrind cd valgrind curl https://chromium.googlesource.com/chromium/src/base/+/master/third_party/valgrind/valgrind.h?format=TEXT | base64 -d > valgrind.h curl https://chromium.googlesource.com/chromium/src/base/+/master/third_party/valgrind/memcheck.h?format=TEXT | base64 -d > memcheck.h
NOTE: If system/bt is checked out under AOSP, then create symbolic links instead of downloading sources
cd system/bt mkdir third_party cd third_party ln -s ../../../external/aac aac ln -s ../../../external/libchrome libchrome ln -s ../../../external/libldac libldac ln -s ../../../external/modp_b64 modp_b64 ln -s ../../../external/tinyxml2 tinyxml2 ln -s ../../../external/googletest googletest
cd ~/fluoride/bt gn gen out/Default
cd ~/fluoride/bt ninja -C out/Default all
This will build all targets (the shared library, executables, tests, etc) and put them in out/Default. To build an individual target, replace "all" with the target of your choice, e.g. ninja -C out/Default net_test_osi.
cd ~/fluoride/bt/out/Default LD_LIBRARY_PATH=./ ./bluetoothtbd -create-ipc-socket=fluoride
Follows the Chromium project Eclipse Setup Instructions until "Optional: Building inside Eclipse" section (don't do that section, we will set it up differently)
Generate Eclipse settings:
cd system/bt gn gen --ide=eclipse out/Default
In Eclipse, do File->Import->C/C++->C/C++ Project Settings, choose the XML location under system/bt/out/Default
Right click on the project. Go to Preferences->C/C++ Build->Builder Settings. Uncheck "Use default build command", but instead using "ninja -C out/Default"
Goto Behaviour tab, change clean command to "-t clean"