Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f456f32e authored by Chia-I Wu's avatar Chia-I Wu
Browse files

surfaceflinger: protect Client::mParentLayer with a lock 

Updates to wp<> is not atomic.  Use Client::mLock to protect
mParentLayer.

Bug: 38505866
Test: camera and youtube work
Change-Id: I2739382d5bb99961a47c1011963b6f676d34eec6
parent c175253b

services/surfaceflinger/Client.cpp

+15 −4
Original line number Diff line number Diff line
@@ -57,9 +57,19 @@ Client::~Client() 
}



void Client::setParentLayer(const sp<Layer>& parentLayer) {

    Mutex::Autolock _l(mLock);

    mParentLayer = parentLayer;

}



sp<Layer> Client::getParentLayer(bool* outParentDied) const {

    Mutex::Autolock _l(mLock);

    sp<Layer> parent = mParentLayer.promote();

    if (outParentDied != nullptr) {

        *outParentDied = (mParentLayer != nullptr && parent == nullptr);

    }

    return parent;

}



status_t Client::initCheck() const {

    return NO_ERROR;

}
@@ -108,7 +118,7 @@ status_t Client::onTransact( 
     // We grant an exception in the case that the Client has a "parent layer", as its

     // effects will be scoped to that layer.

     if (CC_UNLIKELY(pid != self_pid && uid != AID_GRAPHICS && uid != AID_SYSTEM && uid != 0)

             && (mParentLayer.promote() == nullptr)) {

             && (getParentLayer() == nullptr)) {

         // we're called from a different process, do the real check

         if (!PermissionCache::checkCallingPermission(sAccessSurfaceFlinger))

         {
@@ -135,11 +145,12 @@ status_t Client::createSurface( 
            return NAME_NOT_FOUND;

        }

    }

    if (parent == nullptr && mParentLayer != nullptr) {

        parent = mParentLayer.promote();

    if (parent == nullptr) {

        bool parentDied;

        parent = getParentLayer(&parentDied);

        // If we had a parent, but it died, we've lost all

        // our capabilities.

        if (parent == nullptr) {

        if (parentDied) {

            return NAME_NOT_FOUND;

        }

    }

services/surfaceflinger/Client.h

+2 −1
Original line number Diff line number Diff line
@@ -71,12 +71,13 @@ private: 
    virtual status_t onTransact(

        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);



    sp<Layer> getParentLayer(bool* outParentDied = nullptr) const;



    // constant

    sp<SurfaceFlinger> mFlinger;



    // protected by mLock

    DefaultKeyedVector< wp<IBinder>, wp<Layer> > mLayers;



    wp<Layer> mParentLayer;



    // thread-safe