diff options
| author | Mark Yao <mark.yao@rock-chips.com> | 2016-06-26 21:49:21 -0400 |
|---|---|---|
| committer | Mark Yao <mark.yao@rock-chips.com> | 2016-06-29 22:03:01 -0400 |
| commit | 99e2a21625d7228f2d61da6e09c701fb4f836ca8 (patch) | |
| tree | fe21fec54a4261c147ef51c61db29009b6b9afd0 | |
| parent | 47e7aba999eeca7b2db97ca388bc9c42524eec8e (diff) | |
| download | drm_gralloc-99e2a21625d7228f2d61da6e09c701fb4f836ca8.tar.gz | |
drm_gralloc: fix random crash with wildpointerandroid-wear-n-preview-2android-wear-7.1.1_r1android-n-preview-5android-n-iot-preview-2nougat-mr1-wear-releasen-iot-preview-2
two drm handle may use same bo, but there is no
reference protect. if one of the drm handle release
the bo, another handle's bo become a wildpointer,
any read/write on the wildpointer will cause system
unstable, crash.
Change-Id: Ieaca522e3372dba82c48961499b9b657ca33cd15
Signed-off-by: Mark Yao <mark.yao@rock-chips.com>
| -rw-r--r-- | gralloc_drm.cpp | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/gralloc_drm.cpp b/gralloc_drm.cpp index 6f90a84..b0328b0 100644 --- a/gralloc_drm.cpp +++ b/gralloc_drm.cpp @@ -194,7 +194,15 @@ static struct gralloc_drm_bo_t *validate_handle(buffer_handle_t _handle, */ int gralloc_drm_handle_register(buffer_handle_t handle, struct gralloc_drm_t *drm) { - return (validate_handle(handle, drm)) ? 0 : -EINVAL; + struct gralloc_drm_bo_t *bo; + + bo = validate_handle(handle, drm); + if (!bo) + return -EINVAL; + + bo->refcount++; + + return 0; } /* @@ -208,6 +216,7 @@ int gralloc_drm_handle_unregister(buffer_handle_t handle) if (!bo) return -EINVAL; + gralloc_drm_bo_decref(bo); if (bo->imported) gralloc_drm_bo_decref(bo); |