commit 3a9d53a1acf8cecfa6e8ef04bef5f1c47111057b
author Naseer Ahmed <naseer@codeaurora.org> Wed Mar 15 19:21:40 2017 -0400
committer Naseer Ahmed <naseer@codeaurora.org> Mon Mar 20 12:19:54 2017 -0400
tree 5c3dd75ba80244d1c6d60b1c5a53db623acbd458
parent 08c3e40f155ae1d0b86dfc9ec86a5be588c410d0

gralloc1: Import ion handle into registering process

Importing the ion handle when retain() is called validates the
incoming ion fd and holds the client process accountable for
releasing the handle once it's done.

CRs-Fixed: 2020175
Change-Id: I3a169983b6d6b201d044e1c777a631aa16f9cb9a

libgralloc1/gr_ion_alloc.cpp

diff --git a/libgralloc1/gr_ion_alloc.cpp b/libgralloc1/gr_ion_alloc.cpp
index b76fa9f..25792e5 100644
--- a/libgralloc1/gr_ion_alloc.cpp
+++ b/libgralloc1/gr_ion_alloc.cpp
@@ -123,11 +123,13 @@
   if (base) {
     err = UnmapBuffer(base, size, offset);
   }
-  struct ion_handle_data handle_data;
-  handle_data.handle = ion_handle;
-  ioctl(ion_dev_fd_, INT(ION_IOC_FREE), &handle_data);
-  close(fd);
 
+  if (ion_handle > 0) {
+    struct ion_handle_data handle_data;
+    handle_data.handle = ion_handle;
+    ioctl(ion_dev_fd_, INT(ION_IOC_FREE), &handle_data);
+  }
+  close(fd);
   return err;
 }
 
@@ -150,6 +152,18 @@
   return err;
 }
 
+int IonAlloc::ImportBuffer(int fd) {
+  struct ion_fd_data fd_data;
+  int err = 0;
+  fd_data.fd = fd;
+  if (ioctl(ion_dev_fd_, INT(ION_IOC_IMPORT), &fd_data)) {
+    err = -errno;
+    ALOGE("%s: ION_IOC_IMPORT failed with error - %s", __FUNCTION__, strerror(errno));
+    return err;
+  }
+  return fd_data.handle;
+}
+
 int IonAlloc::UnmapBuffer(void *base, unsigned int size, unsigned int /*offset*/) {
   ATRACE_CALL();
   ALOGD_IF(DEBUG, "ion: Unmapping buffer  base:%p size:%u", base, size);
@@ -163,23 +177,13 @@
   return err;
 }
 
-int IonAlloc::CleanBuffer(void *base, unsigned int size, unsigned int offset, int fd, int op) {
+int IonAlloc::CleanBuffer(void *base, unsigned int size, unsigned int offset, int handle, int op) {
   ATRACE_CALL();
   ATRACE_INT("operation id", op);
   struct ion_flush_data flush_data;
-  struct ion_fd_data fd_data;
-  struct ion_handle_data handle_data;
   int err = 0;
 
-  fd_data.fd = fd;
-  if (ioctl(ion_dev_fd_, INT(ION_IOC_IMPORT), &fd_data)) {
-    err = -errno;
-    ALOGE("%s: ION_IOC_IMPORT failed with error - %s", __FUNCTION__, strerror(errno));
-    return err;
-  }
-
-  handle_data.handle = fd_data.handle;
-  flush_data.handle = fd_data.handle;
+  flush_data.handle = handle;
   flush_data.vaddr = base;
   // offset and length are unsigned int
   flush_data.offset = offset;
@@ -202,12 +206,9 @@
   if (ioctl(ion_dev_fd_, INT(ION_IOC_CUSTOM), &d)) {
     err = -errno;
     ALOGE("%s: ION_IOC_CLEAN_INV_CACHES failed with error - %s", __FUNCTION__, strerror(errno));
-    ioctl(ion_dev_fd_, INT(ION_IOC_FREE), &handle_data);
     return err;
   }
 
-  ioctl(ion_dev_fd_, INT(ION_IOC_FREE), &handle_data);
-
   return 0;
 }