Merge "libui: harden GraphicBufferMapper::importBuffer" (d1c0dc88) · Commits · e / os / android_frameworks_native

libs/ui/Android.bp

+1 −0

Original line number	Diff line number	Diff line
		@@ -71,6 +71,7 @@ cc_library_shared {
		shared_libs: [
		"android.hardware.graphics.allocator@2.0",
		"android.hardware.graphics.mapper@2.0",
		"android.hardware.graphics.mapper@2.1",
		"android.hardware.configstore@1.0",
		"android.hardware.configstore-utils",
		"libbase",

libs/ui/Gralloc2.cpp

+51 −1

Original line number	Diff line number	Diff line
		@@ -39,9 +39,15 @@ void Mapper::preload() {
		Mapper::Mapper()
		{
		mMapper = IMapper::getService();
		if (mMapper == nullptr \|\| mMapper->isRemote()) {
		if (mMapper == nullptr) {
		LOG_ALWAYS_FATAL("gralloc-mapper is missing");
		}
		if (mMapper->isRemote()) {
		LOG_ALWAYS_FATAL("gralloc-mapper must be in passthrough mode");
		}

		// IMapper 2.1 is optional
		mMapperV2_1 = hardware::graphics::mapper::V2_1::IMapper::castFrom(mMapper);
		}

		Error Mapper::createDescriptor(
		@@ -91,6 +97,50 @@ void Mapper::freeBuffer(buffer_handle_t bufferHandle) const
		buffer, error);
		}

		Error Mapper::validateBufferSize(buffer_handle_t bufferHandle,
		const IMapper::BufferDescriptorInfo& descriptorInfo,
		uint32_t stride) const
		{
		if (mMapperV2_1 == nullptr) {
		return Error::NONE;
		}

		auto buffer = const_cast<native_handle_t*>(bufferHandle);
		auto ret = mMapperV2_1->validateBufferSize(buffer, descriptorInfo, stride);

		return (ret.isOk()) ? static_cast<Error>(ret) : kTransactionError;
		}

		void Mapper::getTransportSize(buffer_handle_t bufferHandle,
		uint32_t* outNumFds, uint32_t* outNumInts) const
		{
		*outNumFds = uint32_t(bufferHandle->numFds);
		*outNumInts = uint32_t(bufferHandle->numInts);

		if (mMapperV2_1 == nullptr) {
		return;
		}

		Error error;
		auto buffer = const_cast<native_handle_t*>(bufferHandle);
		auto ret = mMapperV2_1->getTransportSize(buffer,
		[&](const auto& tmpError, const auto& tmpNumFds, const auto& tmpNumInts) {
		error = tmpError;
		if (error != Error::NONE) {
		return;
		}

		*outNumFds = tmpNumFds;
		*outNumInts = tmpNumInts;
		});

		if (!ret.isOk()) {
		error = kTransactionError;
		}
		ALOGE_IF(error != Error::NONE, "getTransportSize(%p) failed with %d",
		buffer, error);
		}

		Error Mapper::lock(buffer_handle_t bufferHandle, uint64_t usage,
		const IMapper::Rect& accessRegion,
		int acquireFence, void** outData) const

libs/ui/GraphicBuffer.cpp

+16 −10

Original line number	Diff line number	Diff line
		@@ -170,6 +170,8 @@ status_t GraphicBuffer::initWithSize(uint32_t inWidth, uint32_t inHeight,
		inUsage, &handle, &outStride, mId,
		std::move(requestorName));
		if (err == NO_ERROR) {
		mBufferMapper.getTransportSize(handle, &mTransportNumFds, &mTransportNumInts);

		width = static_cast<int>(inWidth);
		height = static_cast<int>(inHeight);
		format = inFormat;
		@@ -199,7 +201,8 @@ status_t GraphicBuffer::initWithHandle(const native_handle_t* handle,

		if (method == TAKE_UNREGISTERED_HANDLE \|\| method == CLONE_HANDLE) {
		buffer_handle_t importedHandle;
		status_t err = mBufferMapper.importBuffer(handle, &importedHandle);
		status_t err = mBufferMapper.importBuffer(handle, width, height,
		layerCount, format, usage, stride, &importedHandle);
		if (err != NO_ERROR) {
		initWithHandle(nullptr, WRAP_HANDLE, 0, 0, 0, 0, 0, 0);

		@@ -212,6 +215,7 @@ status_t GraphicBuffer::initWithHandle(const native_handle_t* handle,
		}

		handle = importedHandle;
		mBufferMapper.getTransportSize(handle, &mTransportNumFds, &mTransportNumInts);
		}

		ANativeWindowBuffer::handle = handle;
		@@ -323,11 +327,11 @@ status_t GraphicBuffer::unlockAsync(int *fenceFd)
		}

		size_t GraphicBuffer::getFlattenedSize() const {
		return static_cast<size_t>(13 + (handle ? handle->numInts : 0)) * sizeof(int);
		return static_cast<size_t>(13 + (handle ? mTransportNumInts : 0)) * sizeof(int);
		}

		size_t GraphicBuffer::getFdCount() const {
		return static_cast<size_t>(handle ? handle->numFds : 0);
		return static_cast<size_t>(handle ? mTransportNumFds : 0);
		}

		status_t GraphicBuffer::flatten(void& buffer, size_t& size, int& fds, size_t& count) const {
		@@ -353,18 +357,18 @@ status_t GraphicBuffer::flatten(void& buffer, size_t& size, int& fds, size_t&
		buf[12] = int(usage >> 32); // high 32-bits

		if (handle) {
		buf[10] = handle->numFds;
		buf[11] = handle->numInts;
		memcpy(fds, handle->data, static_cast<size_t>(handle->numFds) * sizeof(int));
		buf[10] = int32_t(mTransportNumFds);
		buf[11] = int32_t(mTransportNumInts);
		memcpy(fds, handle->data, static_cast<size_t>(mTransportNumFds) * sizeof(int));
		memcpy(buf + 13, handle->data + handle->numFds,
		static_cast<size_t>(handle->numInts) * sizeof(int));
		static_cast<size_t>(mTransportNumInts) * sizeof(int));
		}

		buffer = static_cast<void>(static_cast<uint8_t>(buffer) + sizeNeeded);
		size -= sizeNeeded;
		if (handle) {
		fds += handle->numFds;
		count -= static_cast<size_t>(handle->numFds);
		fds += mTransportNumFds;
		count -= static_cast<size_t>(mTransportNumFds);
		}

		return NO_ERROR;
		@@ -457,7 +461,8 @@ status_t GraphicBuffer::unflatten(

		if (handle != 0) {
		buffer_handle_t importedHandle;
		status_t err = mBufferMapper.importBuffer(handle, &importedHandle);
		status_t err = mBufferMapper.importBuffer(handle, uint32_t(width), uint32_t(height),
		uint32_t(layerCount), format, usage, uint32_t(stride), &importedHandle);
		if (err != NO_ERROR) {
		width = height = stride = format = usage_deprecated = 0;
		layerCount = 0;
		@@ -470,6 +475,7 @@ status_t GraphicBuffer::unflatten(
		native_handle_close(handle);
		native_handle_delete(const_cast<native_handle_t*>(handle));
		handle = importedHandle;
		mBufferMapper.getTransportSize(handle, &mTransportNumFds, &mTransportNumInts);
		}

		buffer = static_cast<void const>(static_cast<uint8_t const>(buffer) + sizeNeeded);

libs/ui/GraphicBufferMapper.cpp

+29 −4

Original line number	Diff line number	Diff line
		@@ -52,19 +52,44 @@ GraphicBufferMapper::GraphicBufferMapper()
		}

		status_t GraphicBufferMapper::importBuffer(buffer_handle_t rawHandle,
		uint32_t width, uint32_t height, uint32_t layerCount,
		PixelFormat format, uint64_t usage, uint32_t stride,
		buffer_handle_t* outHandle)
		{
		ATRACE_CALL();

		buffer_handle_t bufferHandle;
		Gralloc2::Error error = mMapper->importBuffer(
		hardware::hidl_handle(rawHandle), outHandle);

		ALOGW_IF(error != Gralloc2::Error::NONE, "importBuffer(%p) failed: %d",
		rawHandle, error);
		hardware::hidl_handle(rawHandle), &bufferHandle);
		if (error != Gralloc2::Error::NONE) {
		ALOGW("importBuffer(%p) failed: %d", rawHandle, error);
		return static_cast<status_t>(error);
		}

		Gralloc2::IMapper::BufferDescriptorInfo info = {};
		info.width = width;
		info.height = height;
		info.layerCount = layerCount;
		info.format = static_cast<Gralloc2::PixelFormat>(format);
		info.usage = usage;
		error = mMapper->validateBufferSize(bufferHandle, info, stride);
		if (error != Gralloc2::Error::NONE) {
		ALOGE("validateBufferSize(%p) failed: %d", rawHandle, error);
		freeBuffer(bufferHandle);
		return static_cast<status_t>(error);
		}

		*outHandle = bufferHandle;

		return NO_ERROR;
		}

		void GraphicBufferMapper::getTransportSize(buffer_handle_t handle,
		uint32_t* outTransportNumFds, uint32_t* outTransportNumInts)
		{
		mMapper->getTransportSize(handle, outTransportNumFds, outTransportNumInts);
		}

		status_t GraphicBufferMapper::freeBuffer(buffer_handle_t handle)
		{
		ATRACE_CALL();

libs/ui/include/ui/Gralloc2.h

+9 −0

Original line number	Diff line number	Diff line
		@@ -21,6 +21,7 @@

		#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
		#include <android/hardware/graphics/mapper/2.0/IMapper.h>
		#include <android/hardware/graphics/mapper/2.1/IMapper.h>
		#include <utils/StrongPointer.h>

		namespace android {
		@@ -55,6 +56,13 @@ public:

		void freeBuffer(buffer_handle_t bufferHandle) const;

		Error validateBufferSize(buffer_handle_t bufferHandle,
		const IMapper::BufferDescriptorInfo& descriptorInfo,
		uint32_t stride) const;

		void getTransportSize(buffer_handle_t bufferHandle,
		uint32_t* outNumFds, uint32_t* outNumInts) const;

		// The ownership of acquireFence is always transferred to the callee, even
		// on errors.
		Error lock(buffer_handle_t bufferHandle, uint64_t usage,
		@@ -73,6 +81,7 @@ public:

		private:
		sp<IMapper> mMapper;
		sp<hardware::graphics::mapper::V2_1::IMapper> mMapperV2_1;
		};

		// A wrapper to IAllocator