From a820057ae00dba322b10d47b3711b04519324690 Mon Sep 17 00:00:00 2001
From: Ady Abraham <adyabr@google.com>
Date: Mon, 6 Jun 2022 15:16:06 -0700
Subject: RESTRICT AUTOMERGE SurfaceFlinger: fix a potential race condition in
 stealReceiveChannel

Add a mutex to prevent a potential race condition.

Bug: 232541124
Test: See bug for details
Change-Id: Ia338f124c786bf12d6adba10a67b9048fe9c34a5
---
 services/surfaceflinger/Scheduler/EventThread.cpp | 5 +++++
 services/surfaceflinger/Scheduler/EventThread.h   | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/services/surfaceflinger/Scheduler/EventThread.cpp b/services/surfaceflinger/Scheduler/EventThread.cpp
index cee36a121f..cf57664cd5 100644
--- a/services/surfaceflinger/Scheduler/EventThread.cpp
+++ b/services/surfaceflinger/Scheduler/EventThread.cpp
@@ -138,6 +138,11 @@ void EventThreadConnection::onFirstRef() {
 }
 
 status_t EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) {
+    std::scoped_lock lock(mLock);
+    if (mChannel.initCheck() != NO_ERROR) {
+        return NAME_NOT_FOUND;
+    }
+
     outChannel->setReceiveFd(mChannel.moveReceiveFd());
     return NO_ERROR;
 }
diff --git a/services/surfaceflinger/Scheduler/EventThread.h b/services/surfaceflinger/Scheduler/EventThread.h
index 64acbd72d0..831bf7baa9 100644
--- a/services/surfaceflinger/Scheduler/EventThread.h
+++ b/services/surfaceflinger/Scheduler/EventThread.h
@@ -98,7 +98,8 @@ public:
 private:
     virtual void onFirstRef();
     EventThread* const mEventThread;
-    gui::BitTube mChannel;
+    std::mutex mLock;
+    gui::BitTube mChannel GUARDED_BY(mLock);
 };
 
 class EventThread {
-- 
cgit v1.2.3