[libcamera-devel,v2] android: camera_device: Fix crash in calling CameraDevice::close()
diff mbox series

Message ID 20210831183347.900666-1-hiroh@chromium.org
State Superseded
Headers show
Series
  • [libcamera-devel,v2] android: camera_device: Fix crash in calling CameraDevice::close()
Related show

Commit Message

Hirokazu Honda Aug. 31, 2021, 6:33 p.m. UTC 
The problem is happening because we seem to add a CameraStream
associated buffer(depending on the CameraStream::Type) to the Request,
in CameraDevice::processCaptureRequest().

However, when the camera stops, all the current buffers are marked with
FrameMetadata::FrameCancelled and proceed to completion. But the buffer
associated with the CameraStream (that was previously added to the
request) has now been cleared out with a part of streams_.clear(), even
before the camera stop() has been invoked. Any access to those request
buffers after they have been cleared, shall result in a crash.

Signed-off-by: Hirokazu Honda <hiroh@chromium.org>
---
 src/android/camera_device.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Patch
diff mbox series 

diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp
index 8ca76719..bbe36509 100644
--- a/src/android/camera_device.cpp
+++ b/src/android/camera_device.cpp
@@ -423,8 +423,6 @@  int CameraDevice::open(const hw_module_t *hardwareModule)
 
 void CameraDevice::close()
 {
-	streams_.clear();
-
 	stop();
 
 	camera_->release();
@@ -457,6 +455,8 @@  void CameraDevice::stop()
 	camera_->stop();
 
 	descriptors_.clear();
+	streams_.clear();
+
 	state_ = State::Stopped;
 }
 
@@ -561,11 +561,11 @@  int CameraDevice::configureStreams(camera3_stream_configuration_t *stream_list)
 	}
 
 	/*
-	 * Clear and remove any existing configuration from previous calls, and
-	 * ensure the required entries are available without further
+	 * Any existing configuration from previous calls has been removed in
+	 * stop(). Ensure the required entries are available without further
 	 * reallocation.
 	 */
-	streams_.clear();
+	ASSERT(streams_.empty());
 	streams_.reserve(stream_list->num_streams);
 
 	std::vector<Camera3StreamConfig> streamConfigs;