diff options
| author | Muncheol Park <mncheol.park@samsung.com> | 2023-05-08 12:22:00 +0900 |
|---|---|---|
| committer | Long Ling <longling@google.com> | 2023-05-16 21:19:33 +0000 |
| commit | 361a1c1ec9f07773283ce7cea5403a3a8fa01bf2 (patch) | |
| tree | 0efbdfd0b4f8c24f49355ec38ea423273ac6a8eb | |
| parent | 90179609edfcd74b801c966d6c960ebef3354a5a (diff) | |
| download | common-361a1c1ec9f07773283ce7cea5403a3a8fa01bf2.tar.gz | |
libhwc2.1 : reset assigned resource when a layer is destroyed
HWC service is crashed due to accessing memory which is already freed.
In destroyLayer, it only delete layer object and pointer in ExynosDisplay.
But ExynosMPP still have pointer of deleted layer object in mAssignedSource.
So when validateDisplay called, it refers the freed memory in resetAssignedState()
layer->resetAssignedResource() is added before delete layer object
so that remove layer info in ExynosMPP.
Bug: 264510390
Test: stop surfaceflinger by command "setprop ctl.stop surfaceflinger"
Change-Id: I5191ae334c7566c8fe503c06784aae0e6be1ea81
(cherry picked from commit 261c8ec1328812c2e99e9cac86c635ba875990bb)
| -rw-r--r-- | libhwc2.1/libdevice/ExynosDisplay.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libhwc2.1/libdevice/ExynosDisplay.cpp b/libhwc2.1/libdevice/ExynosDisplay.cpp index fe927ae..26fd635 100644 --- a/libhwc2.1/libdevice/ExynosDisplay.cpp +++ b/libhwc2.1/libdevice/ExynosDisplay.cpp @@ -1173,6 +1173,7 @@ int32_t ExynosDisplay::destroyLayer(hwc2_layer_t outLayer) { } mDisplayInterface->destroyLayer(layer); + layer->resetAssignedResource(); delete layer; |