Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 518bcf5f authored by Eino-Ville Talvala's avatar Eino-Ville Talvala
Browse files

DO NOT MERGE: CameraService: Link to client binder death at end of connect 

If, within a binder Looper thread, a Binder object death notifier is
registered, and then a nested Binder transaction is begun, that
transaction may process a death notification callback for the
just-registered object, if it was dead at the time of registration.

This can lead to an unexpected nested call into the service, and cause
deadlock.

To avoid this, move the death notifier registration to the end of
handling the connect transaction.

Also remove one extra bit of disconnect logging.

Bug: 23525545
Change-Id: If01cbaf42704f55134118afefc9a8f7bdb014e09
parent 79f424c7

services/camera/libcameraservice/CameraService.cpp

+11 −3
Original line number Diff line number Diff line
@@ -937,6 +937,16 @@ void CameraService::finishConnectLocked(const sp<BasicClient>& client, 
        LOG_ALWAYS_FATAL("%s: Invalid state for CameraService, clients not evicted properly",

                __FUNCTION__);

    }



    // And register a death notification for the client callback. Do

    // this last to avoid Binder policy where a nested Binder

    // transaction might be pre-empted to service the client death

    // notification if the client process dies before linkToDeath is

    // invoked.

    sp<IBinder> remoteCallback = client->getRemote();

    if (remoteCallback != nullptr) {

        remoteCallback->linkToDeath(this);

    }

}



status_t CameraService::handleEvictionsLocked(const String8& cameraId, int clientPid,
@@ -1876,11 +1886,9 @@ CameraService::BasicClient::~BasicClient() { 


void CameraService::BasicClient::disconnect() {

    if (mDisconnected) {

        ALOGE("%s: Disconnect called on already disconnected client for device %d", __FUNCTION__,

                mCameraId);

        return;

    }

    mDisconnected = true;;

    mDisconnected = true;



    mCameraService->removeByClient(this);

    mCameraService->logDisconnected(String8::format("%d", mCameraId), mClientPid,

services/camera/libcameraservice/CameraService.h

+0 −5
Original line number Diff line number Diff line
@@ -859,11 +859,6 @@ status_t CameraService::connectHelper(const sp<CALLBACK>& cameraCb, const String 
            return ret;

        }



        sp<IBinder> remoteCallback = client->getRemote();

        if (remoteCallback != nullptr) {

            remoteCallback->linkToDeath(this);

        }



        // Update shim paremeters for legacy clients

        if (effectiveApiLevel == API_1) {

            // Assume we have always received a Client subclass for API1