Merge "SurfaceFlinger: Validate layers before casting." into qt-dev (d003e461) · Commits · e / os / platform_frameworks_native

libs/gui/include/gui/SurfaceControl.h

+3 −6

Original line number	Diff line number	Diff line
		@@ -84,6 +84,9 @@ public:

		explicit SurfaceControl(const sp<SurfaceControl>& other);

		SurfaceControl(const sp<SurfaceComposerClient>& client, const sp<IBinder>& handle,
		const sp<IGraphicBufferProducer>& gbp, bool owned);

		private:
		// can't be copied
		SurfaceControl& operator = (SurfaceControl& rhs);
		@@ -92,12 +95,6 @@ private:
		friend class SurfaceComposerClient;
		friend class Surface;

		SurfaceControl(
		const sp<SurfaceComposerClient>& client,
		const sp<IBinder>& handle,
		const sp<IGraphicBufferProducer>& gbp,
		bool owned);

		~SurfaceControl();

		sp<Surface> generateSurfaceLocked() const;

services/surfaceflinger/Client.cpp

+1 −10

Original line number	Diff line number	Diff line
		@@ -76,18 +76,9 @@ status_t Client::createSurface(const String8& name, uint32_t w, uint32_t h, Pixe
		uint32_t flags, const sp<IBinder>& parentHandle,
		LayerMetadata metadata, sp<IBinder>* handle,
		sp<IGraphicBufferProducer>* gbp) {
		sp<Layer> parent = nullptr;
		if (parentHandle != nullptr) {
		auto layerHandle = reinterpret_cast<Layer::Handle*>(parentHandle.get());
		parent = layerHandle->owner.promote();
		if (parent == nullptr) {
		return NAME_NOT_FOUND;
		}
		}

		// We rely on createLayer to check permissions.
		return mFlinger->createLayer(name, this, w, h, format, flags, std::move(metadata), handle, gbp,
		&parent);
		parentHandle);
		}

		status_t Client::createWithSurfaceParent(const String8& name, uint32_t w, uint32_t h,

services/surfaceflinger/Layer.cpp

+0 −1

Original line number	Diff line number	Diff line
		@@ -125,7 +125,6 @@ Layer::~Layer() {
		}

		mFrameTracker.logAndResetStats(mName);

		mFlinger->onLayerDestroyed();
		}

services/surfaceflinger/RefreshRateOverlay.cpp

+2 −2

Original line number	Diff line number	Diff line
		@@ -31,9 +31,9 @@ bool RefreshRateOverlay::createLayer() {
		const status_t ret =
		mFlinger.createLayer(String8("RefreshRateOverlay"), mClient, 0, 0,
		PIXEL_FORMAT_RGBA_8888, ISurfaceComposerClient::eFXSurfaceColor,
		LayerMetadata(), &mIBinder, &mGbp, &mLayer);
		LayerMetadata(), &mIBinder, &mGbp, nullptr);
		if (ret) {
		ALOGE("failed to color layer");
		ALOGE("failed to create color layer");
		return false;
		}

services/surfaceflinger/SurfaceFlinger.cpp

+77 −41

Original line number	Diff line number	Diff line
		@@ -3389,12 +3389,20 @@ status_t SurfaceFlinger::addClientLayer(const sp<Client>& client,
		const sp<IBinder>& handle,
		const sp<IGraphicBufferProducer>& gbc,
		const sp<Layer>& lbc,
		const sp<Layer>& parent,
		const sp<IBinder>& parentHandle,
		bool addToCurrentState)
		{
		// add this layer to the current state list
		{
		Mutex::Autolock _l(mStateLock);
		sp<Layer> parent;
		if (parentHandle != nullptr) {
		parent = fromHandle(parentHandle);
		if (parent == nullptr) {
		return NAME_NOT_FOUND;
		}
		}

		if (mNumLayers >= MAX_LAYERS) {
		ALOGE("AddClientLayer failed, mNumLayers (%zu) >= MAX_LAYERS (%zu)", mNumLayers,
		MAX_LAYERS);
		@@ -4005,10 +4013,10 @@ uint32_t SurfaceFlinger::addInputWindowCommands(const InputWindowCommands& input
		return flags;
		}

		status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& client, uint32_t w,
		uint32_t h, PixelFormat format, uint32_t flags,
		LayerMetadata metadata, sp<IBinder>* handle,
		sp<IGraphicBufferProducer>* gbp, sp<Layer>* parent) {
		status_t SurfaceFlinger::createLayer(
		const String8& name, const sp<Client>& client, uint32_t w, uint32_t h, PixelFormat format,
		uint32_t flags, LayerMetadata metadata, sp<IBinder>* handle,
		sp<IGraphicBufferProducer>* gbp, const sp<IBinder>& parentHandle) {
		if (int32_t(w\|h) < 0) {
		ALOGE("createLayer() failed, w or h is negative (w=%d, h=%d)",
		int(w), int(h));
		@@ -4073,12 +4081,14 @@ status_t SurfaceFlinger::createLayer(const String8& name, const sp<Client>& clie
		return result;
		}

		mLayersByLocalBinderToken.emplace((*handle)->localBinder(), layer);

		if (primaryDisplayOnly) {
		layer->setPrimaryDisplayOnly();
		}

		bool addToCurrentState = callingThreadHasUnscopedSurfaceFlingerAccess();
		result = addClientLayer(client, handle, gbp, layer, *parent,
		result = addClientLayer(client, handle, gbp, layer, parentHandle,
		addToCurrentState);
		if (result != NO_ERROR) {
		return result;
		@@ -4196,6 +4206,16 @@ void SurfaceFlinger::onHandleDestroyed(sp<Layer>& layer)
		mCurrentState.layersSortedByZ.remove(layer);
		}
		markLayerPendingRemovalLocked(layer);

		auto it = mLayersByLocalBinderToken.begin();
		while (it != mLayersByLocalBinderToken.end()) {
		if (it->second == layer) {
		it = mLayersByLocalBinderToken.erase(it);
		} else {
		it++;
		}
		}

		layer.clear();
		}

		@@ -5462,11 +5482,18 @@ status_t SurfaceFlinger::captureLayers(
		const bool mChildrenOnly;
		};

		auto layerHandle = reinterpret_cast<Layer::Handle*>(layerHandleBinder.get());
		auto parent = layerHandle->owner.promote();
		int reqWidth = 0;
		int reqHeight = 0;
		sp<Layer> parent;
		Rect crop(sourceCrop);
		std::unordered_set<sp<Layer>, ISurfaceComposer::SpHash<Layer>> excludeLayers;

		{
		Mutex::Autolock _l(mStateLock);

		parent = fromHandle(layerHandleBinder);
		if (parent == nullptr \|\| parent->isRemovedFromCurrentState()) {
		ALOGE("captureLayers called with a removed parent");
		ALOGE("captureLayers called with an invalid or removed parent");
		return NAME_NOT_FOUND;
		}

		@@ -5477,7 +5504,6 @@ status_t SurfaceFlinger::captureLayers(
		return PERMISSION_DENIED;
		}

		Rect crop(sourceCrop);
		if (sourceCrop.width() <= 0) {
		crop.left = 0;
		crop.right = parent->getBufferSize(parent->getCurrentState()).getWidth();
		@@ -5487,9 +5513,19 @@ status_t SurfaceFlinger::captureLayers(
		crop.top = 0;
		crop.bottom = parent->getBufferSize(parent->getCurrentState()).getHeight();
		}
		reqWidth = crop.width() * frameScale;
		reqHeight = crop.height() * frameScale;

		int32_t reqWidth = crop.width() * frameScale;
		int32_t reqHeight = crop.height() * frameScale;
		for (const auto& handle : excludeHandles) {
		sp<Layer> excludeLayer = fromHandle(handle);
		if (excludeLayer != nullptr) {
		excludeLayers.emplace(excludeLayer);
		} else {
		ALOGW("Invalid layer handle passed as excludeLayer to captureLayers");
		return NAME_NOT_FOUND;
		}
		}
		} // mStateLock

		// really small crop or frameScale
		if (reqWidth <= 0) {
		@@ -5499,18 +5535,6 @@ status_t SurfaceFlinger::captureLayers(
		reqHeight = 1;
		}

		std::unordered_set<sp<Layer>, ISurfaceComposer::SpHash<Layer>> excludeLayers;
		for (const auto& handle : excludeHandles) {
		BBinder* local = handle->localBinder();
		if (local != nullptr) {
		auto layerHandle = reinterpret_cast<Layer::Handle*>(local);
		excludeLayers.emplace(layerHandle->owner.promote());
		} else {
		ALOGW("Invalid layer handle passed as excludeLayer to captureLayers");
		return NAME_NOT_FOUND;
		}
		}

		LayerRenderArea renderArea(this, parent, crop, reqWidth, reqHeight, reqDataspace, childrenOnly);
		auto traverseLayers = [parent, childrenOnly,
		&excludeLayers](const LayerVector::Visitor& visitor) {
		@@ -5852,6 +5876,18 @@ void SurfaceFlinger::SetInputWindowsListener::onSetInputWindowsFinished() {
		mFlinger->setInputWindowsFinished();
		}

		sp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) {
		BBinder *b = handle->localBinder();
		if (b == nullptr) {
		return nullptr;
		}
		auto it = mLayersByLocalBinderToken.find(b);
		if (it != mLayersByLocalBinderToken.end()) {
		return it->second.promote();
		}
		return nullptr;
		}

		} // namespace android

		#if defined(__gl_h_)