Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e74c228e authored by Eino-Ville Talvala's avatar Eino-Ville Talvala
Browse files

Camera3Device: Close hole in prepare in-use stream check 

There's a narrow window in which a capture request is neither in the
request queue or handed off to the HAL, which can be expanded to some
size if buffers have to be allocated.  During this window, the
prepare() method will not correctly notice that a stream should be
considered in use.

Add a member to contain the current request being processed, and check
against it in prepare as well.

Change-Id: I3a198d617f5feee0a3332af4b4439f24eda28ea3
parent ad9cb8b8

services/camera/libcameraservice/device3/Camera3Device.cpp

+18 −0
Original line number Diff line number Diff line
@@ -2865,6 +2865,12 @@ bool Camera3Device::RequestThread::threadLoop() { 
        nextRequest->mSettings.unlock(request.settings);

    }



    // Unset as current request

    {

        Mutex::Autolock l(mRequestLock);

        mNextRequest.clear();

    }



    // Remove any previously queued triggers (after unlock)

    res = removeTriggers(mPrevRequest);

    if (res != OK) {
@@ -2890,6 +2896,13 @@ bool Camera3Device::RequestThread::isStreamPending( 
        sp<Camera3StreamInterface>& stream) {

    Mutex::Autolock l(mRequestLock);



    if (mNextRequest != nullptr) {

        for (const auto& s : mNextRequest->mOutputStreams) {

            if (stream == s) return true;

        }

        if (stream == mNextRequest->mInputStream) return true;

    }



    for (const auto& request : mRequestQueue) {

        for (const auto& s : request->mOutputStreams) {

            if (stream == s) return true;
@@ -2924,6 +2937,9 @@ void Camera3Device::RequestThread::cleanUpFailedRequest( 
        nextRequest->mOutputStreams.editItemAt(i)->returnBuffer(

            outputBuffers[i], 0);

    }



    Mutex::Autolock l(mRequestLock);

    mNextRequest.clear();

}



sp<Camera3Device::CaptureRequest>
@@ -3007,6 +3023,8 @@ sp<Camera3Device::CaptureRequest> 
        nextRequest->mResultExtras.afTriggerId = mCurrentAfTriggerId;

        nextRequest->mResultExtras.precaptureTriggerId = mCurrentPreCaptureTriggerId;

    }

    mNextRequest = nextRequest;



    return nextRequest;

}

services/camera/libcameraservice/device3/Camera3Device.h

+4 −0
Original line number Diff line number Diff line
@@ -501,6 +501,10 @@ class Camera3Device : 
        Condition          mRequestSignal;

        RequestList        mRequestQueue;

        RequestList        mRepeatingRequests;

        // The next request being prepped for submission to the HAL, no longer

        // on the request queue. Read-only even with mRequestLock held, outside

        // of threadLoop

        sp<const CaptureRequest> mNextRequest;



        bool               mReconfigured;