diff options
author | Ady Abraham <adyabr@google.com> | 2022-06-06 15:16:06 -0700 |
---|---|---|
committer | Ady Abraham <adyabr@google.com> | 2022-06-06 23:46:58 +0000 |
commit | 899e8cd0749cb3f43bef0bdb28002edab42bbb1b (patch) | |
tree | c70d25b64f61f65647329b1dcc2450e6d0fcaeec | |
parent | 47e41ac3c1a2502f675ca3d29812a3ef2d32d4a5 (diff) | |
download | native-899e8cd0749cb3f43bef0bdb28002edab42bbb1b.tar.gz |
SurfaceFlinger: fix a potential race condition in stealReceiveChannel
Add a mutex to prevent a potential race condition.
Bug: 232541124
Test: See bug for details
Change-Id: Ia338f124c786bf12d6adba10a67b9048fe9c34a5
-rw-r--r-- | services/surfaceflinger/Scheduler/EventThread.cpp | 5 | ||||
-rw-r--r-- | services/surfaceflinger/Scheduler/EventThread.h | 3 |
2 files changed, 7 insertions, 1 deletions
diff --git a/services/surfaceflinger/Scheduler/EventThread.cpp b/services/surfaceflinger/Scheduler/EventThread.cpp index cbea77e8fb..639ba5a3f1 100644 --- a/services/surfaceflinger/Scheduler/EventThread.cpp +++ b/services/surfaceflinger/Scheduler/EventThread.cpp @@ -177,6 +177,11 @@ void EventThreadConnection::onFirstRef() { } binder::Status EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) { + std::scoped_lock lock(mLock); + if (mChannel.initCheck() != NO_ERROR) { + return binder::Status::fromStatusT(NAME_NOT_FOUND); + } + outChannel->setReceiveFd(mChannel.moveReceiveFd()); outChannel->setSendFd(base::unique_fd(dup(mChannel.getSendFd()))); return binder::Status::ok(); diff --git a/services/surfaceflinger/Scheduler/EventThread.h b/services/surfaceflinger/Scheduler/EventThread.h index c406478c17..adb96fd462 100644 --- a/services/surfaceflinger/Scheduler/EventThread.h +++ b/services/surfaceflinger/Scheduler/EventThread.h @@ -112,7 +112,8 @@ public: private: virtual void onFirstRef(); EventThread* const mEventThread; - gui::BitTube mChannel; + std::mutex mLock; + gui::BitTube mChannel GUARDED_BY(mLock); std::vector<DisplayEventReceiver::Event> mPendingEvents; }; |