SF: Fix UAF on every resolution switch
Because resolution switching destroys the DisplayDevice, the commit that
finalizes the modeset dereferences stray pointers to its FrameTargeter.
Fix this by bailing out and committing again.
Fixes: 352197706
Flag: EXEMPT bugfix
Test: No SEGV_MTESERR crash on caiman with eng build
Change-Id: I7ad3b5f44041e5307781c826d11057b12913b58d
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index 1e2c087..5600d19 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -730,7 +730,11 @@
Fps maxFps);
void initiateDisplayModeChanges() REQUIRES(kMainThreadContext) REQUIRES(mStateLock);
- void finalizeDisplayModeChange(PhysicalDisplayId) REQUIRES(kMainThreadContext)
+
+ // Returns whether the commit stage should proceed. The return value is ignored when finalizing
+ // immediate mode changes, which happen toward the end of the commit stage.
+ // TODO: b/355427258 - Remove the return value once the `synced_resolution_switch` flag is live.
+ bool finalizeDisplayModeChange(PhysicalDisplayId) REQUIRES(kMainThreadContext)
REQUIRES(mStateLock);
void dropModeRequest(PhysicalDisplayId) REQUIRES(kMainThreadContext);