{"id":13631,"url":"https://patchwork.libcamera.org/api/patches/13631/?format=json","web_url":"https://patchwork.libcamera.org/patch/13631/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210906140152.636883-2-jacopo@jmondi.org>","date":"2021-09-06T14:01:48","name":"[libcamera-devel,1/5] android: camera_device: Fix crash in calling CameraDevice::close()","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"dc5ff59ea4bbbbb9c1f80341e9368c8c41a9a1b9","submitter":{"id":3,"url":"https://patchwork.libcamera.org/api/people/3/?format=json","name":"Jacopo Mondi","email":"jacopo@jmondi.org"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/13631/mbox/","series":[{"id":2448,"url":"https://patchwork.libcamera.org/api/series/2448/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=2448","date":"2021-09-06T14:01:47","name":"android: Fix descriptors_ clean up","version":1,"mbox":"https://patchwork.libcamera.org/series/2448/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/13631/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/13631/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 0D679BDC71\n\tfor ;\n\tMon, 6 Sep 2021 14:01:11 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id C02FC69168;\n\tMon, 6 Sep 2021 16:01:10 +0200 (CEST)","from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net\n\t[217.70.183.194])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id EE3C360137\n\tfor ;\n\tMon, 6 Sep 2021 16:01:08 +0200 (CEST)","(Authenticated sender: jacopo@jmondi.org)\n\tby relay2-d.mail.gandi.net (Postfix) with ESMTPSA id ED2D44000E;\n\tMon, 6 Sep 2021 14:01:07 +0000 (UTC)"],"From":"Jacopo Mondi ","To":"libcamera-devel@lists.libcamera.org","Date":"Mon, 6 Sep 2021 16:01:48 +0200","Message-Id":"<20210906140152.636883-2-jacopo@jmondi.org>","X-Mailer":"git-send-email 2.32.0","In-Reply-To":"<20210906140152.636883-1-jacopo@jmondi.org>","References":"<20210906140152.636883-1-jacopo@jmondi.org>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH 1/5] android: camera_device: Fix crash in\n\tcalling CameraDevice::close()","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"From: Hirokazu Honda \n\nThe problem is happening because we seem to add a CameraStream\nassociated buffer (depending on the CameraStream::Type) to the Request,\nin CameraDevice::processCaptureRequest().\n\nHowever, when the camera stops, all the current buffers are marked with\nFrameMetadata::FrameCancelled and proceed to completion. But the buffer\nassociated with the CameraStream (that was previously added to the\nrequest) has now been cleared out with a part of streams_.clear(), even\nbefore the camera stop() has been invoked. Any access to those request\nbuffers after they have been cleared, will result in a crash.\n\nSigned-off-by: Hirokazu Honda \nReviewed-by: Laurent Pinchart \nReviewed-by: Umang Jain \nReviewed-by: Jacopo Mondi \n---\n src/android/camera_device.cpp | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)","diff":"diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex 8ca76719a50f..fda77db4540c 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -423,8 +423,6 @@ int CameraDevice::open(const hw_module_t *hardwareModule)\n \n void CameraDevice::close()\n {\n-\tstreams_.clear();\n-\n \tstop();\n \n \tcamera_->release();\n@@ -457,6 +455,8 @@ void CameraDevice::stop()\n \tcamera_->stop();\n \n \tdescriptors_.clear();\n+\tstreams_.clear();\n+\n \tstate_ = State::Stopped;\n }\n \n","prefixes":["libcamera-devel","1/5"]}