Merge tag 'LA.UM.5.6.r1-07500-89xx.0' of https://source.codeaurora.org/quic/la/platform/hardware/qcom/display into cm-14.1-caf-8996cm-14.1-caf-8996

"LA.UM.5.6.r1-07500-89xx.0"

Change-Id: I4519ff5fc9d2745030b9a180698c9178613e7157

6 files changed, 119 insertions, 14 deletions

diff --git a/libgralloc/mapper.cpp b/libgralloc/mapper.cpp
index fd9aa33ac..aba272af4 100644
--- a/libgralloc/mapper.cpp
+++ b/libgralloc/mapper.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 The Android Open Source Project
- * Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016, 2017 The Linux Foundation. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -71,7 +71,7 @@ static int gralloc_map_metadata(buffer_handle_t handle) {
                   hnd, hnd->fd_metadata, strerror(errno));
             return -errno;
         }
-        hnd->base_metadata = uint64_t(mappedAddress) + hnd->offset_metadata;
+        hnd->base_metadata = uint64_t(mappedAddress);
     }
     return 0;
 }
@@ -102,7 +102,7 @@ static int gralloc_map(gralloc_module_t const* module,
             return -errno;
         }
 
-        hnd->base = uint64_t(mappedAddress) + hnd->offset;
+        hnd->base = uint64_t(mappedAddress);
     } else {
         // Cannot map secure buffers or framebuffers, but still need to map
         // metadata for secure buffers.
diff --git a/libgralloc1/gr_buf_mgr.cpp b/libgralloc1/gr_buf_mgr.cpp
index eda76ba2b..1b6a9ac5b 100644
--- a/libgralloc1/gr_buf_mgr.cpp
+++ b/libgralloc1/gr_buf_mgr.cpp
@@ -490,6 +490,10 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
       int format = va_arg(args, int);
 
       native_handle_t **handle = va_arg(args, native_handle_t **);
+      if (!handle) {
+        return GRALLOC1_ERROR_BAD_HANDLE;
+      }
+
       private_handle_t *hnd = reinterpret_cast<private_handle_t *>(
           native_handle_create(private_handle_t::kNumFds, private_handle_t::NumInts()));
       if (hnd) {
@@ -498,7 +502,7 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
         hnd->flags = private_handle_t::PRIV_FLAGS_USES_ION;
         hnd->size = size;
         hnd->offset = offset;
-        hnd->base = uint64_t(base) + offset;
+        hnd->base = uint64_t(base);
         hnd->gpuaddr = 0;
         hnd->width = width;
         hnd->height = height;
@@ -512,6 +516,10 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
       int format = va_arg(args, int);
       int *stride = va_arg(args, int *);
       unsigned int alignedw = 0, alignedh = 0;
+
+      if (!stride) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       BufferDescriptor descriptor(width, width, format);
       allocator_->GetAlignedWidthAndHeight(descriptor, &alignedw, &alignedh);
       *stride = INT(alignedw);
@@ -524,6 +532,9 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
 
+      if (!stride) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       MetaData_t *metadata = reinterpret_cast<MetaData_t *>(hnd->base_metadata);
       if (metadata && metadata->operation & UPDATE_BUFFER_GEOMETRY) {
         *stride = metadata->bufferDim.sliceWidth;
@@ -541,6 +552,9 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
 
+      if (!stride || !height) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       MetaData_t *metadata = reinterpret_cast<MetaData_t *>(hnd->base_metadata);
       if (metadata && metadata->operation & UPDATE_BUFFER_GEOMETRY) {
         *stride = metadata->bufferDim.sliceWidth;
@@ -565,6 +579,10 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
       int *aligned_width = va_arg(args, int *);
       int *aligned_height = va_arg(args, int *);
       int *tile_enabled = va_arg(args, int *);
+      if (!aligned_width || !aligned_height || !tile_enabled) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
+
       unsigned int alignedw, alignedh;
       BufferDescriptor descriptor(width, height, format, prod_usage, cons_usage);
       *tile_enabled = allocator_->IsUBwcEnabled(format, prod_usage, cons_usage) ||
@@ -578,9 +596,14 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
     case GRALLOC_MODULE_PERFORM_GET_COLOR_SPACE_FROM_HANDLE: {
       private_handle_t *hnd = va_arg(args, private_handle_t *);
       int *color_space = va_arg(args, int *);
+
       if (private_handle_t::validate(hnd) != 0) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
+
+      if (!color_space) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       MetaData_t *metadata = reinterpret_cast<MetaData_t *>(hnd->base_metadata);
       if (!metadata) {
         return GRALLOC1_ERROR_BAD_HANDLE;
@@ -612,6 +635,10 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
       if (private_handle_t::validate(hnd) != 0) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
+
+      if (!ycbcr) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       if (allocator_->GetYUVPlaneInfo(hnd, ycbcr)) {
         return GRALLOC1_ERROR_UNDEFINED;
       }
@@ -620,9 +647,13 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
     case GRALLOC_MODULE_PERFORM_GET_MAP_SECURE_BUFFER_INFO: {
       private_handle_t *hnd = va_arg(args, private_handle_t *);
       int *map_secure_buffer = va_arg(args, int *);
+
       if (private_handle_t::validate(hnd) != 0) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
+      if (!map_secure_buffer) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       MetaData_t *metadata = reinterpret_cast<MetaData_t *>(hnd->base_metadata);
       if (metadata && metadata->operation & MAP_SECURE_BUFFER) {
         *map_secure_buffer = metadata->mapSecureBuffer;
@@ -634,18 +665,28 @@ gralloc1_error_t BufferManager::Perform(int operation, va_list args) {
     case GRALLOC_MODULE_PERFORM_GET_UBWC_FLAG: {
       private_handle_t *hnd = va_arg(args, private_handle_t *);
       int *flag = va_arg(args, int *);
+
       if (private_handle_t::validate(hnd) != 0) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
+
+      if (!flag) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       *flag = hnd->flags &private_handle_t::PRIV_FLAGS_UBWC_ALIGNED;
     } break;
 
     case GRALLOC_MODULE_PERFORM_GET_RGB_DATA_ADDRESS: {
       private_handle_t *hnd = va_arg(args, private_handle_t *);
       void **rgb_data = va_arg(args, void **);
+
       if (private_handle_t::validate(hnd) != 0) {
         return GRALLOC1_ERROR_BAD_HANDLE;
       }
+
+      if (!rgb_data) {
+        return GRALLOC1_ERROR_BAD_VALUE;
+      }
       if (allocator_->GetRgbDataAddress(hnd, rgb_data)) {
         return GRALLOC1_ERROR_UNDEFINED;
       }
diff --git a/libgralloc1/gr_device_impl.cpp b/libgralloc1/gr_device_impl.cpp
index 62589413d..4f1ff7d7d 100644
--- a/libgralloc1/gr_device_impl.cpp
+++ b/libgralloc1/gr_device_impl.cpp
@@ -317,6 +317,10 @@ gralloc1_error_t GrallocImpl::GetColorFormat(gralloc1_device_t *device, buffer_h
 
 gralloc1_error_t GrallocImpl::GetProducerUsage(gralloc1_device_t *device, buffer_handle_t buffer,
                                                gralloc1_producer_usage_t *outUsage) {
+  if (!outUsage) {
+    return GRALLOC1_ERROR_BAD_VALUE;
+  }
+
   gralloc1_error_t status = CheckDeviceAndHandle(device, buffer);
   if (status == GRALLOC1_ERROR_NONE) {
     const private_handle_t *hnd = PRIV_HANDLE_CONST(buffer);
@@ -328,6 +332,10 @@ gralloc1_error_t GrallocImpl::GetProducerUsage(gralloc1_device_t *device, buffer
 
 gralloc1_error_t GrallocImpl::GetBufferStride(gralloc1_device_t *device, buffer_handle_t buffer,
                                               uint32_t *outStride) {
+  if (!outStride) {
+    return GRALLOC1_ERROR_BAD_VALUE;
+  }
+
   gralloc1_error_t status = CheckDeviceAndHandle(device, buffer);
   if (status == GRALLOC1_ERROR_NONE) {
     *outStride = UINT(PRIV_HANDLE_CONST(buffer)->GetStride());
@@ -343,6 +351,10 @@ gralloc1_error_t GrallocImpl::AllocateBuffers(gralloc1_device_t *device, uint32_
     return GRALLOC1_ERROR_BAD_DESCRIPTOR;
   }
 
+  if (!device) {
+    return GRALLOC1_ERROR_BAD_VALUE;
+  }
+
   GrallocImpl const *dev = GRALLOC_IMPL(device);
   const BufferDescriptor *descriptors = reinterpret_cast<const BufferDescriptor *>(dptors);
   gralloc1_error_t status = dev->buf_mgr_->AllocateBuffers(num_dptors, descriptors, outBuffers);
@@ -372,13 +384,26 @@ gralloc1_error_t GrallocImpl::ReleaseBuffer(gralloc1_device_t *device, buffer_ha
   return status;
 }
 
+static inline void CloseFdIfValid(int fd) {
+  if (fd > 0) {
+    close(fd);
+  }
+}
+
 gralloc1_error_t GrallocImpl::LockBuffer(gralloc1_device_t *device, buffer_handle_t buffer,
                                          gralloc1_producer_usage_t prod_usage,
                                          gralloc1_consumer_usage_t cons_usage,
                                          const gralloc1_rect_t *region, void **out_data,
                                          int32_t acquire_fence) {
   gralloc1_error_t status = CheckDeviceAndHandle(device, buffer);
-  if (status == GRALLOC1_ERROR_NONE && (acquire_fence > 0)) {
+
+  if (status != GRALLOC1_ERROR_NONE || !out_data ||
+      !region) {  // currently we ignore the region/rect client wants to lock
+    CloseFdIfValid(acquire_fence);
+    return status;
+  }
+
+  if (acquire_fence > 0) {
     int error = sync_wait(acquire_fence, 1000);
     if (error < 0) {
       ALOGE("%s: sync_wait timedout! error = %s", __FUNCTION__, strerror(errno));
@@ -400,8 +425,8 @@ gralloc1_error_t GrallocImpl::LockBuffer(gralloc1_device_t *device, buffer_handl
     return GRALLOC1_ERROR_BAD_VALUE;
   }
 
+  // TODO(user): Need to check if buffer was allocated with the same flags
   status = dev->buf_mgr_->LockBuffer(hnd, prod_usage, cons_usage);
-
   *out_data = reinterpret_cast<void *>(hnd->base);
 
   return status;
@@ -432,11 +457,14 @@ gralloc1_error_t GrallocImpl::LockYCbCrBuffer(gralloc1_device_t* device, buffer_
 gralloc1_error_t GrallocImpl::UnlockBuffer(gralloc1_device_t *device, buffer_handle_t buffer,
                                            int32_t *release_fence) {
   gralloc1_error_t status = CheckDeviceAndHandle(device, buffer);
-
   if (status != GRALLOC1_ERROR_NONE) {
     return status;
   }
 
+  if (!release_fence) {
+    return GRALLOC1_ERROR_BAD_VALUE;
+  }
+
   const private_handle_t *hnd = PRIV_HANDLE_CONST(buffer);
   GrallocImpl const *dev = GRALLOC_IMPL(device);
 
@@ -446,6 +474,10 @@ gralloc1_error_t GrallocImpl::UnlockBuffer(gralloc1_device_t *device, buffer_han
 }
 
 gralloc1_error_t GrallocImpl::Gralloc1Perform(gralloc1_device_t *device, int operation, ...) {
+  if (!device) {
+    return GRALLOC1_ERROR_BAD_VALUE;
+  }
+
   va_list args;
   va_start(args, operation);
   GrallocImpl const *dev = GRALLOC_IMPL(device);
diff --git a/sdm/libs/hwc/hwc_session.cpp b/sdm/libs/hwc/hwc_session.cpp
index ab74439df..b8fb10c89 100644
--- a/sdm/libs/hwc/hwc_session.cpp
+++ b/sdm/libs/hwc/hwc_session.cpp
@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
+* Copyright (c) 2014 - 2016,2018 The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -995,7 +995,7 @@ android::status_t HWCSession::HandleGetDisplayAttributesForConfig(const android:
   DisplayPort sdm_disp_port = kPortDefault;
   int hwc_disp_port = qdutils::DISPLAY_PORT_DEFAULT;
 
-  if (dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES || config < 0) {
     return android::BAD_VALUE;
   }
 
@@ -1612,7 +1612,7 @@ android::status_t HWCSession::GetVisibleDisplayRect(const android::Parcel *input
                                                     android::Parcel *output_parcel) {
   int dpy = input_parcel->readInt32();
 
-  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES) {
     return android::BAD_VALUE;;
   }
 
diff --git a/sdm/libs/hwc2/hwc_session.cpp b/sdm/libs/hwc2/hwc_session.cpp
index 6756780a0..d3c13eee9 100644
--- a/sdm/libs/hwc2/hwc_session.cpp
+++ b/sdm/libs/hwc2/hwc_session.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
  * Not a Contribution.
  *
  * Copyright 2015 The Android Open Source Project
@@ -208,6 +208,9 @@ int HWCSession::Close(hw_device_t *device) {
 
 void HWCSession::GetCapabilities(struct hwc2_device *device, uint32_t *outCount,
                                  int32_t *outCapabilities) {
+  if (!outCount) {
+    return;
+  }
   if (outCapabilities != nullptr && *outCount >= 1) {
     outCapabilities[0] = HWC2_CAPABILITY_SKIP_CLIENT_COLOR_TRANSFORM;
   }
@@ -224,11 +227,20 @@ static hwc2_function_pointer_t AsFP(T function) {
 // Defined in the same order as in the HWC2 header
 
 static int32_t AcceptDisplayChanges(hwc2_device_t *device, hwc2_display_t display) {
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
+    return  HWC2_ERROR_BAD_DISPLAY;
+  }
   return HWCSession::CallDisplayFunction(device, display, &HWCDisplay::AcceptDisplayChanges);
 }
 
 int32_t HWCSession::CreateLayer(hwc2_device_t *device, hwc2_display_t display,
                                 hwc2_layer_t *out_layer_id) {
+  if (!out_layer_id) {
+    return  HWC2_ERROR_BAD_PARAMETER;
+  }
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
+    return  HWC2_ERROR_BAD_DISPLAY;
+  }
   SCOPE_LOCK(locker_);
   return CallDisplayFunction(device, display, &HWCDisplay::CreateLayer, out_layer_id);
 }
@@ -241,6 +253,10 @@ int32_t HWCSession::CreateVirtualDisplay(hwc2_device_t *device, uint32_t width,
     return HWC2_ERROR_BAD_DISPLAY;
   }
 
+  if (!out_display_id || !width || !height || !format) {
+    return  HWC2_ERROR_BAD_PARAMETER;
+  }
+
   HWCSession *hwc_session = static_cast<HWCSession *>(device);
   auto status = hwc_session->CreateVirtualDisplayObject(width, height, format);
   if (status == HWC2::Error::None)
@@ -251,6 +267,9 @@ int32_t HWCSession::CreateVirtualDisplay(hwc2_device_t *device, uint32_t width,
 
 int32_t HWCSession::DestroyLayer(hwc2_device_t *device, hwc2_display_t display,
                                  hwc2_layer_t layer) {
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
+    return  HWC2_ERROR_BAD_DISPLAY;
+  }
   SCOPE_LOCK(locker_);
   return CallDisplayFunction(device, display, &HWCDisplay::DestroyLayer, layer);
 }
@@ -275,7 +294,7 @@ int32_t HWCSession::DestroyVirtualDisplay(hwc2_device_t *device, hwc2_display_t
 void HWCSession::Dump(hwc2_device_t *device, uint32_t *out_size, char *out_buffer) {
   SEQUENCE_WAIT_SCOPE_LOCK(locker_);
 
-  if (!device) {
+  if (!device || !out_size) {
     return;
   }
   auto *hwc_session = static_cast<HWCSession *>(device);
@@ -305,6 +324,10 @@ static int32_t GetActiveConfig(hwc2_device_t *device, hwc2_display_t display,
 static int32_t GetChangedCompositionTypes(hwc2_device_t *device, hwc2_display_t display,
                                           uint32_t *out_num_elements, hwc2_layer_t *out_layers,
                                           int32_t *out_types) {
+  // null_ptr check only for out_num_elements, as out_layers and out_types can be null.
+  if (!out_num_elements) {
+    return  HWC2_ERROR_BAD_PARAMETER;
+  }
   return HWCSession::CallDisplayFunction(device, display, &HWCDisplay::GetChangedCompositionTypes,
                                          out_num_elements, out_layers, out_types);
 }
@@ -1023,7 +1046,7 @@ android::status_t HWCSession::HandleGetDisplayAttributesForConfig(const android:
   int error = android::BAD_VALUE;
   DisplayConfigVariableInfo display_attributes;
 
-  if (dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES || config < 0) {
     return android::BAD_VALUE;
   }
 
@@ -1216,6 +1239,11 @@ android::status_t HWCSession::SetColorModeOverride(const android::Parcel *input_
   auto display = static_cast<hwc2_display_t >(input_parcel->readInt32());
   auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32());
   auto device = static_cast<hwc2_device_t *>(this);
+
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
+    return -EINVAL;
+  }
+
   auto err = CallDisplayFunction(device, display, &HWCDisplay::SetColorMode, mode);
   if (err != HWC2_ERROR_NONE)
     return -EINVAL;
@@ -1563,7 +1591,7 @@ android::status_t HWCSession::GetVisibleDisplayRect(const android::Parcel *input
                                                     android::Parcel *output_parcel) {
   int dpy = input_parcel->readInt32();
 
-  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES) {
     return android::BAD_VALUE;
   }
 
diff --git a/sdm/libs/hwc2/hwc_session.h b/sdm/libs/hwc2/hwc_session.h
index 51d35fa35..f548f8b18 100644
--- a/sdm/libs/hwc2/hwc_session.h
+++ b/sdm/libs/hwc2/hwc_session.h
@@ -48,6 +48,10 @@ class HWCSession : hwc2_device_t, public qClient::BnQClient {
   static int32_t CallDisplayFunction(hwc2_device_t *device, hwc2_display_t display,
                                      HWC2::Error (HWCDisplay::*member)(Args...), Args... args) {
     if (!device) {
+      return HWC2_ERROR_BAD_PARAMETER;
+    }
+
+    if (display >= HWC_NUM_DISPLAY_TYPES) {
       return HWC2_ERROR_BAD_DISPLAY;
     }