commit afe2b1fadd29149ceed639357e44e06e97c3a5ca
author Jesse Hall <jessehall@google.com> Tue Oct 21 11:09:17 2014 -0700
committer Jesse Hall <jessehall@google.com> Tue Oct 21 11:11:53 2014 -0700
tree 9916a67f5e0143c9bc647a899bf0495794729cda
parent 649bafb7ba2c3204295bc3451ff7af7e28e714ed

surfaceflinger: don't close fence fds after passing to queueBuffer

ANativeWindow::queueBuffer takes ownership of the fence fd passed to
it, and will close it before returning. SurfaceFlinger's screenshot
code was also closing the syncFd it passed to queueBuffer. Most of the
time this meant the second close() silently failed, but in a rare race
condition the file descriptor could be reused between the two
close()s.

Bug: 17946343
Change-Id: Ib74fcb1dce52cc21328059c99b7c4c76f41aa3a5

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 419b246..96a8adb 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -3247,10 +3247,8 @@
                 } else {
                     result = BAD_VALUE;
                 }
+                // queueBuffer takes ownership of syncFd
                 window->queueBuffer(window, buffer, syncFd);
-                if (syncFd != -1) {
-                    close(syncFd);
-                }
             }
         } else {
             result = BAD_VALUE;