Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12794d4f authored by Yin-Chia Yeh's avatar Yin-Chia Yeh
Browse files

Camera: fix status tracker race condition 

Request thread may race with disconnect call when device is
disconnected in error condition. Acquire mLock when camera
device is updating status tracker to prevent that race
(status tracker being freed and then updated).
In other places where status tracker is updated, there is
a promoted sp to guarantee status tracker remain alive during
the call.

Test: CTS, manual camera testing
Bug: 62420820, 65432229
Change-Id: Id894b5d3482c64125c114f79dbe746c56048fcbe
Merged-In: Id894b5d3482c64125c114f79dbe746c56048fcbe
parent b4030484

services/camera/libcameraservice/device3/Camera3Device.cpp

+10 −2
Original line number Diff line number Diff line
@@ -2326,8 +2326,12 @@ status_t Camera3Device::registerInFlight(uint32_t frameNumber, 
    if (res < 0) return res;



    if (mInFlightMap.size() == 1) {

        // hold mLock to prevent race with disconnect

        Mutex::Autolock l(mLock);

        if (mStatusTracker != nullptr) {

            mStatusTracker->markComponentActive(mInFlightStatusId);

        }

    }



    return OK;

}
@@ -2353,9 +2357,13 @@ void Camera3Device::removeInFlightMapEntryLocked(int idx) { 


    // Indicate idle inFlightMap to the status tracker

    if (mInFlightMap.size() == 0) {

        // hold mLock to prevent race with disconnect

        Mutex::Autolock l(mLock);

        if (mStatusTracker != nullptr) {

            mStatusTracker->markComponentIdle(mInFlightStatusId, Fence::NO_FENCE);

        }

    }

}



void Camera3Device::removeInFlightRequestIfReadyLocked(int idx) {