Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6478de7 authored by Eino-Ville Talvala's avatar Eino-Ville Talvala
Browse files

Camera2/3: Avoid shutdown race in callback processor. 

It's possible, during shutdown, for callback processor's heap to be
destroyed when it's about to send the callback back to the user.
Properly copy the heap reference to a local variable before unlocking
the mutex.

Bug: 9485959
Change-Id: I301347b77145f19c7ac721b9127dc74f122acce2
parent 241b5279

services/camera/libcameraservice/camera2/CallbackProcessor.cpp

+4 −1
Original line number Diff line number Diff line
@@ -365,6 +365,9 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) { 


        ALOGV("%s: Freeing buffer", __FUNCTION__);

        mCallbackConsumer->unlockBuffer(imgBuffer);



        // mCallbackHeap may get freed up once input mutex is released

        callbackHeap = mCallbackHeap;

    }



    // Call outside parameter lock to allow re-entrancy from notification
@@ -375,7 +378,7 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) { 
            ALOGV("%s: Camera %d: Invoking client data callback",

                    __FUNCTION__, mId);

            l.mRemoteCallback->dataCallback(CAMERA_MSG_PREVIEW_FRAME,

                    mCallbackHeap->mBuffers[heapIdx], NULL);

                    callbackHeap->mBuffers[heapIdx], NULL);

        }

    }