From 90055aa05059865793474dc2c5719a18cdaa3175 Mon Sep 17 00:00:00 2001
From: Ady Abraham <adyabr@google.com>
Date: Wed, 15 May 2019 13:47:16 -0700
Subject: FenceTimeline: Fix a potential race condition

FenceTimeline::updateSignalTimes checks if mQueue is empty without
grabbing the lock. This can lead a situaltion that a threads calls
pop() on an empty queue.

Test: boot
Bug: 132735340
Change-Id: I3007bfc1161797cb4d853506bb354e820bc9105d
---
 libs/ui/FenceTime.cpp          | 2 +-
 libs/ui/include/ui/FenceTime.h | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'libs/ui')

diff --git a/libs/ui/FenceTime.cpp b/libs/ui/FenceTime.cpp
index 340231d352..bdfe04b0dd 100644
--- a/libs/ui/FenceTime.cpp
+++ b/libs/ui/FenceTime.cpp
@@ -279,8 +279,8 @@ void FenceTimeline::push(const std::shared_ptr<FenceTime>& fence) {
 }
 
 void FenceTimeline::updateSignalTimes() {
+    std::lock_guard<std::mutex> lock(mMutex);
     while (!mQueue.empty()) {
-        std::lock_guard<std::mutex> lock(mMutex);
         std::shared_ptr<FenceTime> fence = mQueue.front().lock();
         if (!fence) {
             // The shared_ptr no longer exists and no one cares about the
diff --git a/libs/ui/include/ui/FenceTime.h b/libs/ui/include/ui/FenceTime.h
index a5a1fcbde7..ecba7f73e8 100644
--- a/libs/ui/include/ui/FenceTime.h
+++ b/libs/ui/include/ui/FenceTime.h
@@ -19,6 +19,7 @@
 
 #include <ui/Fence.h>
 #include <utils/Flattenable.h>
+#include <utils/Mutex.h>
 #include <utils/Timers.h>
 
 #include <atomic>
@@ -159,7 +160,7 @@ public:
 
 private:
     mutable std::mutex mMutex;
-    std::queue<std::weak_ptr<FenceTime>> mQueue;
+    std::queue<std::weak_ptr<FenceTime>> mQueue GUARDED_BY(mMutex);
 };
 
 // Used by test code to create or get FenceTimes for a given Fence.
-- 
cgit v1.2.3-59-g8ed1b