Piteball
/
android_hardware_qcom_display
mirror of https://github.com/followmsi/android_hardware_qcom_display.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hwc: Fix request flag reset and Present() bailout 

The ClearRequestFlags() method iterates over layer_stack_ instead of
layer_set_. This causes a use-after-free since DestroyLayer() removes
layer from layer_set_ only. Besides that, the method need not be
virtual and has a redundant loop. This change removes the
ClearRequestFlags() method and clears flags in an existing loop.
Present() bails out if layer_set_ is empty or a shutdown is pending.
Since layers could have been destroyed before Present(), ideally
bailing out on re-validation has a higher priority over the rest.

Bug: 79541227
CRs-Fixed: 2165926
Change-Id: Ic7b31bbd07a22b8df47fccb2024b3415ab3a559b
This commit is contained in:
Saurabh Shah 2018-03-21 19:13:12 +05:30 committed by Alain Vongsouvanh
parent 85a0f2823c
commit 81fdbfedd9
2 changed files with 6 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
msm8909w_3100/sdm/libs/hwc2/hwc_display.cpp
View File

@ -1102,10 +1102,6 @@ HWC2::Error HWCDisplay::GetHdrCapabilities(uint32_t *out_num_types, int32_t *out
HWC2::Error HWCDisplay::CommitLayerStack(void) {
if (shutdown_pending_ || layer_set_.empty()) {
return HWC2::Error::None;
}
if (skip_validate_ && !CanSkipValidate()) {
validated_.reset(type_);
}
@ -1115,6 +1111,10 @@ HWC2::Error HWCDisplay::CommitLayerStack(void) {
return HWC2::Error::NotValidated;
}
if (shutdown_pending_ || layer_set_.empty()) {
return HWC2::Error::None;
}
DumpInputBuffers();
if (!flush_) {
@ -1199,8 +1199,10 @@ HWC2::Error HWCDisplay::PostCommitLayerStack(int32_t *out_retire_fence) {
close(layer_buffer->acquire_fence_fd);
layer_buffer->acquire_fence_fd = -1;
}
layer->request.flags = {};
}
client_target_->GetSDMLayer()->request.flags = {};
*out_retire_fence = -1;
if (!flush_) {
// if swapinterval property is set to 0 then close and reset the list retire fence
@ -1220,8 +1222,6 @@ HWC2::Error HWCDisplay::PostCommitLayerStack(int32_t *out_retire_fence) {
geometry_changes_ = GeometryChanges::kNone;
flush_ = false;
ClearRequestFlags();
return status;
}
@ -1881,12 +1881,6 @@ void HWCDisplay::CloseAcquireFds() {
}
}
void HWCDisplay::ClearRequestFlags() {
for (Layer *layer : layer_stack_.layers) {
layer->request.flags = {};
}
}
std::string HWCDisplay::Dump() {
std::ostringstream os;
os << "-------------------------------" << std::endl;

1
msm8909w_3100/sdm/libs/hwc2/hwc_display.h
View File

@ -240,7 +240,6 @@ class HWCDisplay : public DisplayEventHandler {
bool IsLayerUpdating(const Layer *layer);
uint32_t SanitizeRefreshRate(uint32_t req_refresh_rate);
virtual void CloseAcquireFds();
virtual void ClearRequestFlags();
virtual void GetUnderScanConfig() { }
enum {