Surface: Always consume fence fd in queueBuffer

The API docs for the behaviour of ANativeWindow::queueBuffer state that
it always takes ownership of the fence fd parameter. The
Surface::queueBuffer implementation did not conform to this. If an error
occured within its queueBuffer function, then dependending what the
error was, the fence fd was either left untouched or closed.

This made it impossible for a client of ANativeWindow::queueBuffer to
correctly manage the fence fd if an error occured, resulting it either
an fd leak or a use-after-close scenario.

Change-Id: I3a8169709db3715dbcb3db258ef2056623e653f0

1 files changed, 1 insertions, 1 deletions

diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index b3c8943e1..72d9af314 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -318,6 +318,7 @@ int Surface::queueBuffer(android_native_buffer_t* buffer, int fenceFd) {
     Mutex::Autolock lock(mMutex);
     int64_t timestamp;
     bool isAutoTimestamp = false;
+    sp<Fence> fence(fenceFd >= 0 ? new Fence(fenceFd) : Fence::NO_FENCE);
     if (mTimestamp == NATIVE_WINDOW_TIMESTAMP_AUTO) {
         timestamp = systemTime(SYSTEM_TIME_MONOTONIC);
         isAutoTimestamp = true;
@@ -345,7 +346,6 @@ int Surface::queueBuffer(android_native_buffer_t* buffer, int fenceFd) {
     }
 #endif
 
-    sp<Fence> fence(fenceFd >= 0 ? new Fence(fenceFd) : Fence::NO_FENCE);
     IGraphicBufferProducer::QueueBufferOutput output;
     IGraphicBufferProducer::QueueBufferInput input(timestamp, isAutoTimestamp, crop,
 #ifdef QCOM_BSP