From 65beac9b0ad0d6c73ca5a7a367a30e1d33818c99 Mon Sep 17 00:00:00 2001
From: Rocky Fang <rockyfang@google.com>
Date: Mon, 20 May 2024 21:01:21 +0000
Subject: Release dynamic sensor data at the end of process

This makes sure that sensor service has full control of the life time of
the dynamic sensor data, and will not be affected by when the callback
is invoked.

Fixes: 329020894
Fixes: 337741176
Test: Connect a dynamic sensor to phone, rapidly turn on/off bluetooth to
emulate fast connection/disconnection of dynamic sensor. Not seeing
crash anymore

Change-Id: I6c9b4fa06e08dc1bb0b5e578ee2ec10b95fe84c3
---
 services/sensorservice/SensorDevice.cpp  | 20 ++++++++++++--------
 services/sensorservice/SensorDevice.h    |  8 ++++++++
 services/sensorservice/SensorService.cpp |  1 +
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/services/sensorservice/SensorDevice.cpp b/services/sensorservice/SensorDevice.cpp
index f62562ce9d..9c4d1ace15 100644
--- a/services/sensorservice/SensorDevice.cpp
+++ b/services/sensorservice/SensorDevice.cpp
@@ -429,14 +429,18 @@ void SensorDevice::onDynamicSensorsConnected(const std::vector<sensor_t>& dynami
 }
 
 void SensorDevice::onDynamicSensorsDisconnected(
-        const std::vector<int32_t>& dynamicSensorHandlesRemoved) {
-    if (sensorservice_flags::sensor_device_on_dynamic_sensor_disconnected()) {
-        for (auto handle : dynamicSensorHandlesRemoved) {
-            auto it = mConnectedDynamicSensors.find(handle);
-            if (it != mConnectedDynamicSensors.end()) {
-                mConnectedDynamicSensors.erase(it);
-            }
-        }
+        const std::vector<int32_t>& /*dynamicSensorHandlesRemoved*/) {
+    // This function is currently a no-op has removing data in mConnectedDynamicSensors here will
+    // cause a race condition between when this callback is invoked and when the dynamic sensor meta
+    // event is processed by polling. The clean up should only happen after processing the meta
+    // event. See the call stack of cleanupDisconnectedDynamicSensor.
+}
+
+void SensorDevice::cleanupDisconnectedDynamicSensor(int handle) {
+    std::lock_guard<std::mutex> lock(mDynamicSensorsMutex);
+    auto it = mConnectedDynamicSensors.find(handle);
+    if (it != mConnectedDynamicSensors.end()) {
+        mConnectedDynamicSensors.erase(it);
     }
 }
 
diff --git a/services/sensorservice/SensorDevice.h b/services/sensorservice/SensorDevice.h
index 52f7cf2de8..b7b04b5d00 100644
--- a/services/sensorservice/SensorDevice.h
+++ b/services/sensorservice/SensorDevice.h
@@ -63,6 +63,14 @@ public:
     std::vector<int32_t> getDynamicSensorHandles();
 
     void handleDynamicSensorConnection(int handle, bool connected);
+    /**
+     * Removes handle from connected dynamic sensor list. Note that this method must be called after
+     * SensorService has done using sensor data.
+     *
+     * @param handle of the disconnected dynamic sensor.
+     */
+    void cleanupDisconnectedDynamicSensor(int handle);
+
     status_t initCheck() const;
     int getHalDeviceVersion() const;
 
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index 69e430901a..70ca7025d4 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -1273,6 +1273,7 @@ bool SensorService::threadLoop() {
                 } else {
                     int handle = mSensorEventBuffer[i].dynamic_sensor_meta.handle;
                     disconnectDynamicSensor(handle, activeConnections);
+                    device.cleanupDisconnectedDynamicSensor(handle);
                 }
             }
         }
-- 
cgit v1.2.3-59-g8ed1b