Fix refcounting of mapped bo's

Buffer objects created locally by gralloc_drm_bo_create() would have
their refcount properly initialized to 1, but those received from
other processes via the drv alloc function would be left at zero, so
the delete check in gralloc_drm_bo_decref() would not destroy them as
the refcount would wrap negative.  The buffer would then leak forever
until the mapping process (often surfaceflinger!) exitted.

Issue: AXIA-2991
Change-Id: I1a0c73b21cfbc67b441970002fd71712112e1871
Signed-off-by: Andy Ross <andy.ross@windriver.com>

diff --git a/gralloc_drm.c b/gralloc_drm.c
index 27a49c5..bd38d57 100644 (file)
--- a/gralloc_drm.c
+++ b/gralloc_drm.c
@@ -207,6 +207,7 @@ static struct gralloc_drm_bo_t *validate_handle(buffer_handle_t _handle,
                        bo->drm = drm;
                        bo->imported = 1;
                        bo->handle = handle;
+                       bo->refcount = 1;
                }
 
                handle->data_owner = gralloc_drm_get_pid();