Patch Detail
Show a patch.
GET /api/patches/13583/?format=api
{ "id": 13583, "url": "https://patchwork.libcamera.org/api/patches/13583/?format=api", "web_url": "https://patchwork.libcamera.org/patch/13583/", "project": { "id": 1, "url": "https://patchwork.libcamera.org/api/projects/1/?format=api", "name": "libcamera", "link_name": "libcamera", "list_id": "libcamera_core", "list_email": "libcamera-devel@lists.libcamera.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20210831183347.900666-1-hiroh@chromium.org>", "date": "2021-08-31T18:33:47", "name": "[libcamera-devel,v2] android: camera_device: Fix crash in calling CameraDevice::close()", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "0ca42466effe9df44022dbebd13f718548168219", "submitter": { "id": 63, "url": "https://patchwork.libcamera.org/api/people/63/?format=api", "name": "Hirokazu Honda", "email": "hiroh@chromium.org" }, "delegate": null, "mbox": "https://patchwork.libcamera.org/patch/13583/mbox/", "series": [ { "id": 2428, "url": "https://patchwork.libcamera.org/api/series/2428/?format=api", "web_url": "https://patchwork.libcamera.org/project/libcamera/list/?series=2428", "date": "2021-08-31T18:33:47", "name": "[libcamera-devel,v2] android: camera_device: Fix crash in calling CameraDevice::close()", "version": 2, "mbox": "https://patchwork.libcamera.org/series/2428/mbox/" } ], "comments": "https://patchwork.libcamera.org/api/patches/13583/comments/", "check": "pending", "checks": "https://patchwork.libcamera.org/api/patches/13583/checks/", "tags": {}, "headers": { "Return-Path": "<libcamera-devel-bounces@lists.libcamera.org>", "X-Original-To": "parsemail@patchwork.libcamera.org", "Delivered-To": "parsemail@patchwork.libcamera.org", "Received": [ "from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 3C2BBBDC71\n\tfor <parsemail@patchwork.libcamera.org>;\n\tTue, 31 Aug 2021 18:33:57 +0000 (UTC)", "from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 8BE3E6916A;\n\tTue, 31 Aug 2021 20:33:56 +0200 (CEST)", "from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com\n\t[IPv6:2607:f8b0:4864:20::1031])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id A1EB168890\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tTue, 31 Aug 2021 20:33:55 +0200 (CEST)", "by mail-pj1-x1031.google.com with SMTP id j1so145560pjv.3\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tTue, 31 Aug 2021 11:33:55 -0700 (PDT)", "from hiroh2.tok.corp.google.com\n\t([2401:fa00:8f:203:af31:7c67:f02a:bccc])\n\tby smtp.gmail.com with ESMTPSA id\n\tm28sm22110292pgl.9.2021.08.31.11.33.52\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tTue, 31 Aug 2021 11:33:53 -0700 (PDT)" ], "Authentication-Results": "lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=chromium.org header.i=@chromium.org\n\theader.b=\"RJ8/yoxo\"; dkim-atps=neutral", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org;\n\ts=google; h=from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=S+eqU1bLzA9oEH9EAwbZlhQ2WPYO9EvvDGXfNwtzM4c=;\n\tb=RJ8/yoxowngO8Gjf43h+K4Z4cFQ9Y1IjM3z43y78wPlp3cyc0i0TGULMYJ1lUy6IHD\n\ttHRFuh/IU31ic76ll7rNpqMEgFN9j2zY6d28uyPDuO+MPz9PM701BxqxTigNovMlcT62\n\tlcngdYBdIydJ0mv/5+B5RTVhNd0PMzFI4FWAo=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=S+eqU1bLzA9oEH9EAwbZlhQ2WPYO9EvvDGXfNwtzM4c=;\n\tb=BuDLIK21Yb4RVVnyDTBE8g6JwiBkW741TGRpRFU8aCdLrHB9YCSQ2Spko1PDnJpg10\n\tNMoaxt7DpnWD03f6ya/Cx0JeRlRoyHD5tkMFUfcxKGkPOE7GZ1Ea7ZMV/MKIUA4ahRvA\n\t4XKCCq8xs3RE+lG5/h5HR9Pq/pPQBHNpsni0pB0lxQudcG57mRxozsOOPk3rXbujFmF5\n\tsZsF/i7E+H/0xRox8dbkVbcn1NEd4hr/lVgJKvQNFakiOOUsAYU5tu60v9hQvivohpEk\n\tiknFpJG+rMeX52OyP37bGAKuKzVb1iwMxSn/PFpNhcBkwVyVIcjTbGkgsTHBIujpn+8B\n\teRQg==", "X-Gm-Message-State": "AOAM531teSG08Wa6Da7hwyM4926qy7kGeFQN5Z6OVxvh3DNMyZmy+M7z\n\tB3310vrwS6sEUP27K19FvXI/8F/jF5WEfg==", "X-Google-Smtp-Source": "ABdhPJw3Z13Et5Wp/HPYn2vz0HCukNfZ7jp6QZmtIbgJ9R9HbJbf0zZsVBTtkv9d0shDGU10vmud4Q==", "X-Received": "by 2002:a17:902:7202:b029:12c:dc6b:928f with SMTP id\n\tba2-20020a1709027202b029012cdc6b928fmr5850149plb.55.1630434833721; \n\tTue, 31 Aug 2021 11:33:53 -0700 (PDT)", "From": "Hirokazu Honda <hiroh@chromium.org>", "To": "libcamera-devel@lists.libcamera.org", "Date": "Wed, 1 Sep 2021 03:33:47 +0900", "Message-Id": "<20210831183347.900666-1-hiroh@chromium.org>", "X-Mailer": "git-send-email 2.33.0.259.gc128427fd7-goog", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Subject": "[libcamera-devel] [PATCH v2] android: camera_device: Fix crash in\n\tcalling CameraDevice::close()", "X-BeenThere": "libcamera-devel@lists.libcamera.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "<libcamera-devel.lists.libcamera.org>", "List-Unsubscribe": "<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>", "List-Archive": "<https://lists.libcamera.org/pipermail/libcamera-devel/>", "List-Post": "<mailto:libcamera-devel@lists.libcamera.org>", "List-Help": "<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>", "List-Subscribe": "<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>", "Errors-To": "libcamera-devel-bounces@lists.libcamera.org", "Sender": "\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>" }, "content": "The problem is happening because we seem to add a CameraStream\nassociated buffer(depending on the CameraStream::Type) to the Request,\nin CameraDevice::processCaptureRequest().\n\nHowever, when the camera stops, all the current buffers are marked with\nFrameMetadata::FrameCancelled and proceed to completion. But the buffer\nassociated with the CameraStream (that was previously added to the\nrequest) has now been cleared out with a part of streams_.clear(), even\nbefore the camera stop() has been invoked. Any access to those request\nbuffers after they have been cleared, shall result in a crash.\n\nSigned-off-by: Hirokazu Honda <hiroh@chromium.org>\n---\n src/android/camera_device.cpp | 10 +++++-----\n 1 file changed, 5 insertions(+), 5 deletions(-)", "diff": "diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex 8ca76719..bbe36509 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -423,8 +423,6 @@ int CameraDevice::open(const hw_module_t *hardwareModule)\n \n void CameraDevice::close()\n {\n-\tstreams_.clear();\n-\n \tstop();\n \n \tcamera_->release();\n@@ -457,6 +455,8 @@ void CameraDevice::stop()\n \tcamera_->stop();\n \n \tdescriptors_.clear();\n+\tstreams_.clear();\n+\n \tstate_ = State::Stopped;\n }\n \n@@ -561,11 +561,11 @@ int CameraDevice::configureStreams(camera3_stream_configuration_t *stream_list)\n \t}\n \n \t/*\n-\t * Clear and remove any existing configuration from previous calls, and\n-\t * ensure the required entries are available without further\n+\t * Any existing configuration from previous calls has been removed in\n+\t * stop(). Ensure the required entries are available without further\n \t * reallocation.\n \t */\n-\tstreams_.clear();\n+\tASSERT(streams_.empty());\n \tstreams_.reserve(stream_list->num_streams);\n \n \tstd::vector<Camera3StreamConfig> streamConfigs;\n", "prefixes": [ "libcamera-devel", "v2" ] }