Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 6f1c8350 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

!FIXUP Fix mismerge of android-9.0.0_r54 

* That tag merge was supposed to land e71f0044 ("Fix reinterpret_cast
  security bug"). It clearly didn't.
* I cannot even begin to explain what happened...

Change-Id: Icd963add4dba055911250ff0fedc470cafbe3db6
parent 206c9128

services/surfaceflinger/Client.cpp

+11 −18
Original line number Diff line number Diff line
@@ -106,16 +106,16 @@ void Client::detachLayer(const Layer* layer) 
        }

    }

}

sp<Layer> Client::getLayerUser(const sp<IBinder>& handle) const



bool Client::isAttached(const sp<IBinder>& handle) const

{

    Mutex::Autolock _l(mLock);

    sp<Layer> lbc;

    wp<Layer> layer(mLayers.valueFor(handle));

    if (layer != 0) {

        lbc = layer.promote();

        ALOGE_IF(lbc==0, "getLayerUser(name=%p) is dead", handle.get());

        return true;

    }

    return lbc;

    return false;

}



status_t Client::onTransact(
@@ -148,12 +148,15 @@ status_t Client::createSurface( 
        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,

        const sp<IBinder>& parentHandle, int32_t windowType, int32_t ownerUid,

        sp<IBinder>* handle,

        sp<IGraphicBufferProducer>* gbp) {

        sp<IGraphicBufferProducer>* gbp)

{

    bool parentDied;

    sp<Layer> parentLayer = getParentLayer(&parentDied);

    sp<Layer> parentLayer;

    if (!parentHandle) parentLayer = getParentLayer(&parentDied);

    if (parentHandle == nullptr && parentDied) {

        return NAME_NOT_FOUND;

    }



    return mFlinger->createLayer(name, this, w, h, format, flags, windowType,

                                 ownerUid, handle, gbp, parentHandle, parentLayer);

}
@@ -163,21 +166,11 @@ status_t Client::destroySurface(const sp<IBinder>& handle) { 
}



status_t Client::clearLayerFrameStats(const sp<IBinder>& handle) const {

    sp<Layer> layer = getLayerUser(handle);

    if (layer == nullptr) {

        return NAME_NOT_FOUND;

    }

    layer->clearFrameStats();

    return NO_ERROR;

    return mFlinger->clearLayerFrameStats(this, handle);

}



status_t Client::getLayerFrameStats(const sp<IBinder>& handle, FrameStats* outStats) const {

    sp<Layer> layer = getLayerUser(handle);

    if (layer == nullptr) {

        return NAME_NOT_FOUND;

    }

    layer->getFrameStats(outStats);

    return NO_ERROR;

    return mFlinger->getLayerFrameStats(this, handle, outStats);

}



// ---------------------------------------------------------------------------

services/surfaceflinger/Client.h

+1 −1
Original line number Diff line number Diff line
@@ -49,7 +49,7 @@ public: 


    void detachLayer(const Layer* layer);



    sp<Layer> getLayerUser(const sp<IBinder>& handle) const;

    bool isAttached (const sp<IBinder>& handle) const;



    void updateParent(const sp<Layer>& parentLayer);

services/surfaceflinger/Layer.cpp

+2 −7
Original line number Diff line number Diff line
@@ -162,14 +162,9 @@ Layer::~Layer() { 
void Layer::onLayerDisplayed(const sp<Fence>& /*releaseFence*/) {}



void Layer::onRemovedFromCurrentState() {

    if (!mPendingRemoval) {

    // the layer is removed from SF mCurrentState to mLayersPendingRemoval

    mPendingRemoval = true;



        // remove from sf mapping

        mFlinger->removeLayerFromMap(this);

    }



    if (mCurrentState.zOrderRelativeOf != nullptr) {

        sp<Layer> strongRelative = mCurrentState.zOrderRelativeOf.promote();

        if (strongRelative != nullptr) {

services/surfaceflinger/SurfaceFlinger.cpp

+40 −16
Original line number Diff line number Diff line
@@ -3222,16 +3222,10 @@ status_t SurfaceFlinger::addClientLayer(const sp<Client>& client, const sp<IBind 
    return NO_ERROR;

}



status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) {

    Mutex::Autolock _l(mStateLock);

    return removeLayerLocked(mStateLock, layer, topLevelOnly);

}



status_t SurfaceFlinger::removeLayerFromMap(Layer* layer) {

status_t SurfaceFlinger::removeLayerFromMap(const wp<Layer>& layer) {

    auto it = mLayersByLocalBinderToken.begin();

    while (it != mLayersByLocalBinderToken.end()) {

        auto strongRef = it->second.promote();

        if (strongRef != nullptr && strongRef.get() == layer) {

        if (it->second == layer) {

            it = mLayersByLocalBinderToken.erase(it);

            break;

        } else {
@@ -3245,6 +3239,11 @@ status_t SurfaceFlinger::removeLayerFromMap(Layer* layer) { 
    return NO_ERROR;

}



status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) {

    Mutex::Autolock _l(mStateLock);

    return removeLayerLocked(mStateLock, layer, topLevelOnly);

}



status_t SurfaceFlinger::removeLayerLocked(const Mutex&, const sp<Layer>& layer,

                                           bool topLevelOnly) {

    if (layer->isPendingRemoval()) {
@@ -3490,8 +3489,8 @@ uint32_t SurfaceFlinger::setClientStateLocked(const ComposerState& composerState 
    const layer_state_t& s = composerState.state;

    sp<Client> client(static_cast<Client*>(composerState.client.get()));



    sp<Layer> layer(client->getLayerUser(s.surface));

    if (layer == nullptr) {

    sp<Layer> layer = fromHandle(s.surface);

    if (layer == nullptr || !(client->isAttached(s.surface))) {

        return 0;

    }
@@ -3666,8 +3665,8 @@ void SurfaceFlinger::setDestroyStateLocked(const ComposerState& composerState) { 
    const layer_state_t& state = composerState.state;

    sp<Client> client(static_cast<Client*>(composerState.client.get()));



    sp<Layer> layer(client->getLayerUser(state.surface));

    if (layer == nullptr) {

    sp<Layer> layer = fromHandle(state.surface);

    if (layer == nullptr || !(client->isAttached(state.surface))) {

        return;

    }
@@ -3817,15 +3816,35 @@ status_t SurfaceFlinger::createContainerLayer(const sp<Client>& client, 
    return NO_ERROR;

}



status_t SurfaceFlinger::clearLayerFrameStats(const sp<const Client>& client, const sp<IBinder>& handle) {

    Mutex::Autolock _l(mStateLock);

    sp<Layer> layer = fromHandle(handle);

    if (layer == nullptr || !(client->isAttached(handle))) {

        return NAME_NOT_FOUND;

    }

    layer->clearFrameStats();

    return NO_ERROR;

}



status_t SurfaceFlinger::getLayerFrameStats(const sp<const Client>& client, const sp<IBinder>& handle, FrameStats* outStats) {

    Mutex::Autolock _l(mStateLock);

    sp<Layer> layer = fromHandle(handle);

    if (layer == nullptr || !(client->isAttached(handle))) {

        return NAME_NOT_FOUND;

    }

    layer->getFrameStats(outStats);

    return NO_ERROR;

}



status_t SurfaceFlinger::onLayerRemoved(const sp<Client>& client, const sp<IBinder>& handle)

{

    Mutex::Autolock _l(mStateLock);

    // called by a client when it wants to remove a Layer

    status_t err = NO_ERROR;

    sp<Layer> l(client->getLayerUser(handle));

    if (l != nullptr) {

    sp<Layer> l = fromHandle(handle);

    if (l != nullptr || client->isAttached(handle)) {

        mInterceptor->saveSurfaceDeletion(l);

        err = removeLayer(l);

        err = removeLayerLocked(mStateLock, l);

        ALOGE_IF(err<0 && err != NAME_NOT_FOUND,

                "error removing layer=%p (%s)", l.get(), strerror(-err));

    }
@@ -3834,15 +3853,18 @@ status_t SurfaceFlinger::onLayerRemoved(const sp<Client>& client, const sp<IBind 


status_t SurfaceFlinger::onLayerDestroyed(const wp<Layer>& layer)

{

    Mutex::Autolock _l(mStateLock);

    // called by ~LayerCleaner() when all references to the IBinder (handle)

    // are gone

    sp<Layer> l = layer.promote();

    if (l == nullptr) {

        removeLayerFromMap(layer);

        // The layer has already been removed, carry on

        return NO_ERROR;

    }

    removeLayerFromMap(layer);

    // If we have a parent, then we can continue to live as long as it does.

    return removeLayer(l, true);

    return removeLayerLocked(mStateLock, l, true);

}



// ---------------------------------------------------------------------------
@@ -5315,6 +5337,8 @@ void SurfaceFlinger::traverseLayersInDisplay(const sp<const DisplayDevice>& hw, 
}



sp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) {

    if (!handle) return nullptr;



    BBinder *b = handle->localBinder();

    if (b == nullptr) {

        return nullptr;

services/surfaceflinger/SurfaceFlinger.h

+7 −3
Original line number Diff line number Diff line
@@ -350,6 +350,10 @@ public: 
    bool authenticateSurfaceTextureLocked(

        const sp<IGraphicBufferProducer>& bufferProducer) const;



    status_t clearLayerFrameStats(const sp<const Client>& client, const sp<IBinder>& handle);



    status_t getLayerFrameStats(const sp<const Client>& client, const sp<IBinder>& handle, FrameStats* outStats);



    sp<Layer> fromHandle(const sp<IBinder>& handle) REQUIRES(mStateLock);



private:
@@ -532,9 +536,9 @@ private: 
    uint32_t setTransactionFlags(uint32_t flags, VSyncModulator::TransactionStart transactionStart);

    void commitTransaction();

    bool containsAnyInvalidClientState(const Vector<ComposerState>& states);

    uint32_t setClientStateLocked(const ComposerState& composerState);

    uint32_t setClientStateLocked(const ComposerState& composerState) REQUIRES(mStateLock);

    uint32_t setDisplayStateLocked(const DisplayState& s);

    void setDestroyStateLocked(const ComposerState& composerState);

    void setDestroyStateLocked(const ComposerState& composerState) REQUIRES(mStateLock);



    /* ------------------------------------------------------------------------

     * Layer management
@@ -573,7 +577,7 @@ private: 
    status_t removeLayerLocked(const Mutex&, const sp<Layer>& layer, bool topLevelOnly = false);



    // remove layer from mapping

    status_t removeLayerFromMap(Layer* layer);

    status_t removeLayerFromMap(const wp<Layer>& layer);



    // add a layer to SurfaceFlinger

    status_t addClientLayer(const sp<Client>& client, const sp<IBinder>& handle,