Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7372a60f authored by Dominik Laskowski's avatar Dominik Laskowski
Browse files

SF: Prevent crashes in onRefreshRateChangedDebug 

The AIDL thread reads HWComposer state without locks, but there may be
a concurrent write on the main thread. Also, the display may no longer
exist by the time the scheduled task runs.

Bug: 241285876
Test: presubmit
Change-Id: I3460e23cad2a884250bebcd58b1eaec9cd309858
parent c4fe541e

services/surfaceflinger/SurfaceFlinger.cpp

+14 −13
Original line number Diff line number Diff line
@@ -2225,19 +2225,20 @@ void SurfaceFlinger::onComposerHalVsyncIdle(hal::HWDisplayId) { 


void SurfaceFlinger::onRefreshRateChangedDebug(const RefreshRateChangedDebugData& data) {

    ATRACE_CALL();

    if (const auto displayId = getHwComposer().toPhysicalDisplayId(data.display); displayId) {

    const char* const whence = __func__;

        static_cast<void>(mScheduler->schedule([=, this]() FTL_FAKE_GUARD(mStateLock) {

    static_cast<void>(mScheduler->schedule([=, this]() FTL_FAKE_GUARD(mStateLock) FTL_FAKE_GUARD(

                                                   kMainThreadContext) {

        if (const auto displayIdOpt = getHwComposer().toPhysicalDisplayId(data.display)) {

            if (const auto display = getDisplayDeviceLocked(*displayIdOpt)) {

                const Fps fps = Fps::fromPeriodNsecs(getHwComposer().getComposer()->isVrrSupported()

                                                             ? data.refreshPeriodNanos

                                                             : data.vsyncPeriodNanos);

                ATRACE_FORMAT("%s Fps %d", whence, fps.getIntValue());

            const auto display = getDisplayDeviceLocked(*displayId);

            FTL_FAKE_GUARD(kMainThreadContext,

                display->updateRefreshRateOverlayRate(fps, display->getActiveMode().fps,

                                                                 /* setByHwc */ true));

        }));

                                                      /* setByHwc */ true);

            }

        }

    }));

}



void SurfaceFlinger::configure() {