It is extremely unlikely, but possible.
If out_write passes the null check on the sco_thread, but just before obtaining the stream lock, the sco_thread starts and gets far enough to mess with the pcm, then out_write continues, reopens the pcm, then sco_thread won't be able to open its own pcm.
Fix: move the null check on the sco_thread into the critical area protected by the stream lock.
This;
if (out->adev->sco_thread != 0) return bytes;
stream_lock(&out->lock);
Becomes this;
stream_lock(&out->lock);
if (out->adev->sco_thread != 0){
stream_unlock(&out->lock);
return bytes;
}
https://github.com/lbdroid/android_device_linaro_hikey/blob/094073048d04b84d7bc4ab8ffe1264da0f22c54e/usbaudio/audio_hal.c#L524
It is extremely unlikely, but possible. If out_write passes the null check on the sco_thread, but just before obtaining the stream lock, the sco_thread starts and gets far enough to mess with the pcm, then out_write continues, reopens the pcm, then sco_thread won't be able to open its own pcm.
Fix: move the null check on the sco_thread into the critical area protected by the stream lock.
This;
Becomes this;