commit 2cf827faebace4039cb0c0af0def9efdf454af62
author Ying Wei <whisperwing@google.com> Wed Mar 22 22:25:28 2023 +0000
committer Ying Wei <whisperwing@google.com> Wed Mar 29 23:19:14 2023 +0000
tree 11fe2b4400e879c263d94ef895366f4bc95c3b84
parent 68ca576a8dcffa5764026a7ca9c9b1090ccd63a3

Grab lock before reparenting in SurfaceFlinger commitMirrorDisplays()

Bug: 271644537
Test: n/a
Change-Id: I45384210791bd9280f63d95e3bdaef3d299fc818
(cherry picked from commit 9cba62a07f393d852dabf20b6e4d10e67b29c8d9)
Merged-In: I45384210791bd9280f63d95e3bdaef3d299fc818

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 6a2e347..9ceb0af 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -7913,9 +7913,14 @@
                                          ISurfaceComposerClient::eNoColorFill,
                                          gui::LayerMetadata());
             sp<Layer> childMirror;
-            createEffectLayer(mirrorArgs, &unused, &childMirror);
-            childMirror->setClonedChild(layer->createClone());
-            childMirror->reparent(mirrorDisplay.rootHandle);
+            {
+                Mutex::Autolock lock(mStateLock);
+                createEffectLayer(mirrorArgs, &unused, &childMirror);
+                childMirror->setClonedChild(layer->createClone());
+                childMirror->reparent(mirrorDisplay.rootHandle);
+            }
+            // lock on mStateLock needs to be released before binder handle gets destroyed
+            unused.clear();
         }
     }
     return true;