Merge Android R (rvc-dev-plus-aosp-without-vendor@6692709)

Bug: 166295507
Merged-In: I500b53e89f132b3925e6a1912c75b7834ea47ff4
Change-Id: Ib50a9978c77eda7e20e27f2d63615599f0517b6d

2 files changed, 18 insertions, 4 deletions

diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 30b96eea..103f57dc 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -831,6 +831,7 @@ static ssize_t out_write(struct audio_stream_out *stream, const void* buffer,
     // in the pipe in case capture start was delayed
     {
         const size_t availableToWrite = sink->availableToWrite();
+        // NOTE: rsxSink has been checked above and sink and source life cycles are synchronized
         sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
         const struct submix_stream_in *in = rsxadev->routes[out->route_handle].input;
         const bool dont_block = (in == NULL)
@@ -905,8 +906,14 @@ static int out_get_presentation_position(const struct audio_stream_out *stream,
 
     int ret = -EWOULDBLOCK;
     pthread_mutex_lock(&rsxadev->lock);
-    const ssize_t frames_in_pipe =
-            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
+    if (source == NULL) {
+        ALOGW("%s called on released output", __FUNCTION__);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -ENODEV;
+    }
+
+    const ssize_t frames_in_pipe = source->availableToRead();
     if (CC_UNLIKELY(frames_in_pipe < 0)) {
         *frames = out->frames_written;
         ret = 0;
@@ -939,8 +946,14 @@ static int out_get_render_position(const struct audio_stream_out *stream,
     struct submix_audio_device * const rsxadev = out->dev;
 
     pthread_mutex_lock(&rsxadev->lock);
-    const ssize_t frames_in_pipe =
-            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
+    if (source == NULL) {
+        ALOGW("%s called on released output", __FUNCTION__);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -ENODEV;
+    }
+
+    const ssize_t frames_in_pipe = source->availableToRead();
     if (CC_UNLIKELY(frames_in_pipe < 0)) {
         *dsp_frames = (uint32_t)out->frames_written_since_standby;
     } else {
diff --git a/modules/usbaudio/audio_hal.c b/modules/usbaudio/audio_hal.c
index f0ea015a..a19a0ae3 100644
--- a/modules/usbaudio/audio_hal.c
+++ b/modules/usbaudio/audio_hal.c
@@ -1142,6 +1142,7 @@ static int adev_open_input_stream(struct audio_hw_device *hw_dev,
         // adev_close_input_stream() in this case.
         *stream_in = NULL;
         free(in);
+        return ret;
     }
 
     device_lock(in->adev);