LineageOS/android_vendor_qcom_opensource_display-commonsys-intf
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hwc: Fix request flag reset and Present() bailout

Browse Source 
The ClearRequestFlags() method iterates over layer_stack_ instead of
layer_set_. This causes a use-after-free since DestroyLayer() removes
layer from layer_set_ only. Besides that, the method need not be
virtual and has a redundant loop. This change removes the
ClearRequestFlags() method and clears flags in an existing loop.

Present() bails out if layer_set_ is empty or a shutdown is pending.
Since layers could have been destroyed before Present(), ideally
bailing out on re-validation has a higher priority over the rest.

Change-Id: Ic7b31bbd07a22b8df47fccb2024b3415ab3a559b
CRs-fixed: 2165926
This commit is contained in:
Saurabh Shah
2018-01-15 14:55:46 -08:00
committed by Gerrit - the friendly Code Review server
parent 07254304fa
commit 4118304e5c
2 changed files with 7 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
sdm/libs/hwc2/hwc_display.cpp
View File

@@ -1214,10 +1214,6 @@ HWC2::Error HWCDisplay::GetHdrCapabilities(uint32_t *out_num_types, int32_t *out
HWC2::Error HWCDisplay::CommitLayerStack(void) {
if (shutdown_pending_ || layer_set_.empty()) {
return HWC2::Error::None;
}
if (skip_validate_ && !CanSkipValidate()) {
validated_ = false;
}
@@ -1227,6 +1223,10 @@ HWC2::Error HWCDisplay::CommitLayerStack(void) {
return HWC2::Error::NotValidated;
}
if (shutdown_pending_ || layer_set_.empty()) {
return HWC2::Error::None;
}
DumpInputBuffers();
if (!flush_) {
@@ -1316,8 +1316,11 @@ HWC2::Error HWCDisplay::PostCommitLayerStack(int32_t *out_retire_fence) {
close(layer_buffer->acquire_fence_fd);
layer_buffer->acquire_fence_fd = -1;
}
layer->request.flags = {};
}
client_target_->GetSDMLayer()->request.flags = {};
*out_retire_fence = -1;
if (!flush_) {
// if swapinterval property is set to 0 then close and reset the list retire fence
@@ -1337,8 +1340,6 @@ HWC2::Error HWCDisplay::PostCommitLayerStack(int32_t *out_retire_fence) {
geometry_changes_ = GeometryChanges::kNone;
flush_ = false;
ClearRequestFlags();
return status;
}
@@ -2016,12 +2017,6 @@ DisplayClass HWCDisplay::GetDisplayClass() {
return display_class_;
}
void HWCDisplay::ClearRequestFlags() {
for (Layer *layer : layer_stack_.layers) {
layer->request.flags = {};
}
}
std::string HWCDisplay::Dump() {
std::ostringstream os;
os << "\n------------HWC----------------\n";

1
sdm/libs/hwc2/hwc_display.h
View File

@@ -249,7 +249,6 @@ class HWCDisplay : public DisplayEventHandler {
bool IsSurfaceUpdated(const std::vector<LayerRect> &dirty_regions);
bool IsLayerUpdating(const Layer *layer);
uint32_t SanitizeRefreshRate(uint32_t req_refresh_rate);
virtual void ClearRequestFlags();
virtual void GetUnderScanConfig() { }
enum {