Fix missed protection by lock

 - dequeued_buffers buffer can be NULL in mutex protection.
 - but checking it is NULL is used without mutex protection.
 - so it is need to fix.

Change-Id: Ifd57d769c760cd43f2816ab9477560dc0f1e5ae5

diff --git a/src/tpl_wayland_egl.c b/src/tpl_wayland_egl.c
index d464136..5407f9c 100755 (executable)
--- a/src/tpl_wayland_egl.c
+++ b/src/tpl_wayland_egl.c
@@ -830,12 +830,12 @@ __tpl_wayland_egl_surface_fini(tpl_surface_t *surface)
        }
 
        /* the list of dequeued_buffers just does deletion */
+       TPL_OBJECT_LOCK(&wayland_egl_surface->base);
        if (wayland_egl_surface->dequeued_buffers) {
-               TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                __tpl_list_free(wayland_egl_surface->dequeued_buffers, NULL);
                wayland_egl_surface->dequeued_buffers = NULL;
-               TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
        }
+       TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
 
        __tpl_object_fini(&wayland_egl_surface->base);
        free(wayland_egl_surface);
@@ -1087,13 +1087,13 @@ __tpl_wayland_egl_surface_enqueue_buffer(tpl_surface_t *surface,
                close(sync_fence);
        }
 
+       TPL_OBJECT_LOCK(&wayland_egl_surface->base);
        if (wayland_egl_surface->dequeued_buffers) {
-               TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                /* Stop tracking of this render_done tbm_surface. */
                __tpl_list_remove_data(wayland_egl_surface->dequeued_buffers,
                                                           (void *)tbm_surface, TPL_FIRST, NULL);
-               TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
        }
+       TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
 
        tsq_err = tbm_surface_queue_enqueue(wayland_egl_surface->tbm_queue,
                                                                                tbm_surface);
@@ -1222,13 +1222,13 @@ __tpl_wayland_egl_surface_cancel_dequeued_buffer(tpl_surface_t *surface,
                return TPL_ERROR_INVALID_PARAMETER;
        }
 
+       TPL_OBJECT_LOCK(&wayland_egl_surface->base);
        if (wayland_egl_surface->dequeued_buffers) {
-               TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                /* Stop tracking of this render_done tbm_surface. */
                __tpl_list_remove_data(wayland_egl_surface->dequeued_buffers,
                                                           (void *)tbm_surface, TPL_FIRST, NULL);
-               TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
        }
+       TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
 
        if (!tbm_surface_internal_is_valid(tbm_surface)) {
                TPL_WARN("Invalid buffer. tbm_surface(%p)", tbm_surface);
@@ -1383,13 +1383,13 @@ __tpl_wayland_egl_surface_dequeue_buffer(tpl_surface_t *surface, uint64_t timeou
                wayland_egl_surface->reset = TPL_FALSE;
                wayland_egl_surface->is_activated = is_activated;
 
+               TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                if (wayland_egl_surface->dequeued_buffers) {
-                       TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                        /* Start tracking of this tbm_surface until enqueue */
                        __tpl_list_push_back(wayland_egl_surface->dequeued_buffers,
                                                                 (void *)tbm_surface);
-                       TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
                }
+               TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
 
                TPL_LOG_B("WL_EGL",
                                  "[DEQ][R] tpl_wayland_surface_t(%p) wl_buffer(%p) tbm_surface(%p) bo(%d)",
@@ -1485,12 +1485,12 @@ __tpl_wayland_egl_surface_dequeue_buffer(tpl_surface_t *surface, uint64_t timeou
                          wayland_egl_buffer->window_transform,
                          wayland_egl_buffer->w_rotated ? "[TRUE]" : "[FALSE]");
 
+       TPL_OBJECT_LOCK(&wayland_egl_surface->base);
        if (wayland_egl_surface->dequeued_buffers) {
-               TPL_OBJECT_LOCK(&wayland_egl_surface->base);
                __tpl_list_push_back(wayland_egl_surface->dequeued_buffers,
                                                         (void *)tbm_surface);
-               TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
        }
+       TPL_OBJECT_UNLOCK(&wayland_egl_surface->base);
 
        if (lock_res == 0) pthread_mutex_unlock(&wayland_egl_display->wl_event_mutex);
        return tbm_surface;

diff --git a/src/tpl_wl_egl_thread.c b/src/tpl_wl_egl_thread.c
index 14c3473..23574a3 100755 (executable)
--- a/src/tpl_wl_egl_thread.c
+++ b/src/tpl_wl_egl_thread.c
@@ -2436,14 +2436,16 @@ __tpl_wl_egl_surface_set_post_interval(tpl_surface_t *surface,
 
        TPL_CHECK_ON_NULL_RETURN_VAL(wl_egl_surface, TPL_ERROR_INVALID_PARAMETER);
 
+       tpl_gmutex_lock(&wl_egl_surface->surf_mutex);
+
        TPL_INFO("[SET_POST_INTERVAL]",
                         "wl_egl_surface(%p) post_interval(%d -> %d)",
                         wl_egl_surface, wl_egl_surface->post_interval, post_interval);
 
-       tpl_gmutex_lock(&wl_egl_surface->surf_mutex);
        wl_egl_surface->post_interval = post_interval;
        tpl_gmutex_unlock(&wl_egl_surface->surf_mutex);
 
+
        return TPL_ERROR_NONE;
 }