commit e434a7db4d016769ff3af0cc9410ce09c7414efa
author Presubmit Automerger Backend <android-build-presubmit-automerger-backend@system.gserviceaccount.com> Tue Jun 07 00:04:03 2022 +0000
committer Presubmit Automerger Backend <android-build-presubmit-automerger-backend@system.gserviceaccount.com> Tue Jun 07 00:04:03 2022 +0000
tree fb73cf93be58b0c78802dc8956cfc51e66f2420f
parent 7380dd5932cc1145253a5f7fe170af7e13168f41
parent 29e34cfcf95c6de1f2cbfe2bf588e4e354dbabe0

[automerge] RESTRICT AUTOMERGE SurfaceFlinger: fix a potential race condition in stealReceiveChannel 2p: 29e34cfcf9

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/18766107

Bug: 232541124
Change-Id: I89aa3895c76578f2d67d9082dd2fe91cf029aaec

services/surfaceflinger/Scheduler/EventThread.cpp

diff --git a/services/surfaceflinger/Scheduler/EventThread.cpp b/services/surfaceflinger/Scheduler/EventThread.cpp
index 2321e2d..68f62ba 100644
--- a/services/surfaceflinger/Scheduler/EventThread.cpp
+++ b/services/surfaceflinger/Scheduler/EventThread.cpp
@@ -171,6 +171,11 @@
 }
 
 status_t EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) {
+    std::scoped_lock lock(mLock);
+    if (mChannel.initCheck() != NO_ERROR) {
+        return NAME_NOT_FOUND;
+    }
+
     outChannel->setReceiveFd(mChannel.moveReceiveFd());
     outChannel->setSendFd(base::unique_fd(dup(mChannel.getSendFd())));
     return NO_ERROR;

services/surfaceflinger/Scheduler/EventThread.h

diff --git a/services/surfaceflinger/Scheduler/EventThread.h b/services/surfaceflinger/Scheduler/EventThread.h
index 1e6793f..b15817a 100644
--- a/services/surfaceflinger/Scheduler/EventThread.h
+++ b/services/surfaceflinger/Scheduler/EventThread.h
@@ -102,7 +102,8 @@
 private:
     virtual void onFirstRef();
     EventThread* const mEventThread;
-    gui::BitTube mChannel;
+    std::mutex mLock;
+    gui::BitTube mChannel GUARDED_BY(mLock);
 
     std::vector<DisplayEventReceiver::Event> mPendingEvents;
 };