commit 544a3eb0bd29eb2e16cd21f6aeb95b4acef54296
author Ady Abraham <adyabr@google.com> Tue Jun 07 20:40:56 2022 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Jun 07 20:40:56 2022 +0000
tree 0401feb5e6db206a682215c3d0f4214d9e0d02d8
parent e26b6061f8133757f72f4ec38f094a6c95eed0ac
parent 0840cdd08f39994e3f8c58eb65f24a8db1dc1173

RESTRICT AUTOMERGE SurfaceFlinger: fix a potential race condition in stealReceiveChannel am: 0840cdd08f

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/18766212

Change-Id: I4710ac999b560074a4cacbde6cf22ac1ad000e0d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/surfaceflinger/Scheduler/EventThread.cpp

diff --git a/services/surfaceflinger/Scheduler/EventThread.cpp b/services/surfaceflinger/Scheduler/EventThread.cpp
index 9d1f777..ace0ed5 100644
--- a/services/surfaceflinger/Scheduler/EventThread.cpp
+++ b/services/surfaceflinger/Scheduler/EventThread.cpp
@@ -129,6 +129,11 @@
 }
 
 status_t EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) {
+    std::scoped_lock lock(mLock);
+    if (mChannel.initCheck() != NO_ERROR) {
+        return NAME_NOT_FOUND;
+    }
+
     outChannel->setReceiveFd(mChannel.moveReceiveFd());
     return NO_ERROR;
 }

services/surfaceflinger/Scheduler/EventThread.h

diff --git a/services/surfaceflinger/Scheduler/EventThread.h b/services/surfaceflinger/Scheduler/EventThread.h
index dd23b88..6bcdecd 100644
--- a/services/surfaceflinger/Scheduler/EventThread.h
+++ b/services/surfaceflinger/Scheduler/EventThread.h
@@ -88,7 +88,8 @@
 private:
     virtual void onFirstRef();
     EventThread* const mEventThread;
-    gui::BitTube mChannel;
+    std::mutex mLock;
+    gui::BitTube mChannel GUARDED_BY(mLock);
 };
 
 class EventThread {