Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dbfcb38f authored by Yin-Chia Yeh's avatar Yin-Chia Yeh
Browse files

Camera: fix corner case in eviction logic 

IPCThreadState::self()->getCallingPid() is not reliable
in asynchronous callback (in this case binderDied)

Bug: 70946731
Change-Id: Id90d26ddad8ddf51564baa7bd642e3e4eb535182
parent c3e9d6f7

services/camera/libcameraservice/CameraService.cpp

+2 −5
Original line number Diff line number Diff line
@@ -1733,8 +1733,6 @@ void CameraService::removeByClient(const BasicClient* client) { 
}



bool CameraService::evictClientIdByRemote(const wp<IBinder>& remote) {

    const int callingPid = getCallingPid();

    const int servicePid = getpid();

    bool ret = false;

    {

        // Acquire mServiceLock and prevent other clients from connecting
@@ -1750,8 +1748,7 @@ bool CameraService::evictClientIdByRemote(const wp<IBinder>& remote) { 
                mActiveClientManager.remove(i);

                continue;

            }

            if (remote == clientSp->getRemote() && (callingPid == servicePid ||

                    callingPid == clientSp->getClientPid())) {

            if (remote == clientSp->getRemote()) {

                mActiveClientManager.remove(i);

                evicted.push_back(clientSp);
@@ -2770,7 +2767,7 @@ void CameraService::handleTorchClientBinderDied(const wp<IBinder> &who) { 
      * While tempting to promote the wp<IBinder> into a sp, it's actually not supported by the

      * binder driver

      */



    // PID here is approximate and can be wrong.

    logClientDied(getCallingPid(), String8("Binder died unexpectedly"));



    // check torch client