Fix race condition in ConsumerBase::addReleaseFence()

This needs the ConsumerBase mutex locked, but wasn't locking it. Two
of the four places that called it already held the lock so were fine.
Now addReleaseFence() takes the lock itself, and I added
addReleaseFenceLocked() for the two already-locked callers, since in
one of them dropping the lock would be inconvenient.

Bug: 7289269
Change-Id: I7a5628adb516f8eec782aa6c14128202f96d7b0a

1 files changed, 6 insertions, 1 deletions

diff --git a/libs/gui/ConsumerBase.cpp b/libs/gui/ConsumerBase.cpp
index f5d6ff031e..624d7e0156 100644
--- a/libs/gui/ConsumerBase.cpp
+++ b/libs/gui/ConsumerBase.cpp
@@ -193,7 +193,12 @@ status_t ConsumerBase::acquireBufferLocked(BufferQueue::BufferItem *item) {
 }
 
 status_t ConsumerBase::addReleaseFence(int slot, const sp<Fence>& fence) {
-    CB_LOGV("addReleaseFence: slot=%d", slot);
+    Mutex::Autolock lock(mMutex);
+    return addReleaseFenceLocked(slot, fence);
+}
+
+status_t ConsumerBase::addReleaseFenceLocked(int slot, const sp<Fence>& fence) {
+    CB_LOGV("addReleaseFenceLocked: slot=%d", slot);
 
     if (!mSlots[slot].mFence.get()) {
         mSlots[slot].mFence = fence;