From patchwork Tue Aug 31 08:05:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hirokazu Honda X-Patchwork-Id: 13577 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 167D2BDC71 for ; Tue, 31 Aug 2021 08:05:39 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 6AC076916A; Tue, 31 Aug 2021 10:05:38 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="NHY9pqJs"; dkim-atps=neutral Received: from mail-pg1-x52a.google.com (mail-pg1-x52a.google.com [IPv6:2607:f8b0:4864:20::52a]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id DDD2060288 for ; Tue, 31 Aug 2021 10:05:36 +0200 (CEST) Received: by mail-pg1-x52a.google.com with SMTP id k24so15865152pgh.8 for ; Tue, 31 Aug 2021 01:05:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=OfgCFpUg5bxmnBY7sJSl/IFw+BTnL273/QXyF1Oy1Ec=; b=NHY9pqJs1vs8rLQ1nL2HX/hz/gvtLEH8jXvwYyJ3mLsPXlrKkHbaRIU5RXP4mVCC7O 1yc99AAcRus4HnUUc3hrL1QZLCy4N1CbZH5euDqj+3v3eAvBrHpyROdL7yHmzyZJRoeg NZTHNFqjCkPJptg5VoFPCUUS+qtOFKlwYghCM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=OfgCFpUg5bxmnBY7sJSl/IFw+BTnL273/QXyF1Oy1Ec=; b=nh2/CNwd4j9mlKEnhS5POY/JhbzkFLt0z3dPsmVcbAh/sBCVf9AzKkibw6WlU33dZz Hxi6h1gsc9cmRp4Itt295rr44Y92eYEyHPTMhBiCLYbIf6OE8vO2nE25jvxKPxxr/JGl dOyNWdFhSIybTGa4Y5S6ekL7H8r1o7cjnQMKCDWqDj5gkvzNjJjg+oxSX7uu43qzQhRH q3GnyGrODZgZIY3KY/7NxY1um4Hupj3b1bMrCkM1znLoQXWpc3qUFNIaXkqwEmV+nfWy eVehX3ggxWlW7TsVNJKOlY8AdYdaDj9bWOdUShFRJItBMjNyfMa8J96BwRWj4igxyA7y bIGg== X-Gm-Message-State: AOAM53138sVZBLA4bidyqFHQpnMcwNceimAD998sBUsnNzHaUSjByq5P uJ+a4La9+q7DPbBchDj/A4JeVJsyyhmByw== X-Google-Smtp-Source: ABdhPJx+Egh5JE/GQGBOm9zIU3ul6hylc/IF2de5OBC2+ZvxN1vyw29Qibj3xyhiLPW0MllUvYoqqw== X-Received: by 2002:a62:17c3:0:b0:3f5:b942:119e with SMTP id 186-20020a6217c3000000b003f5b942119emr19718967pfx.53.1630397134967; Tue, 31 Aug 2021 01:05:34 -0700 (PDT) Received: from hiroh2.tok.corp.google.com ([2401:fa00:8f:203:3c62:aba4:18ea:5441]) by smtp.gmail.com with ESMTPSA id m28sm20117913pgl.9.2021.08.31.01.05.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 31 Aug 2021 01:05:34 -0700 (PDT) From: Hirokazu Honda To: libcamera-devel@lists.libcamera.org Date: Tue, 31 Aug 2021 17:05:28 +0900 Message-Id: <20210831080528.835236-1-hiroh@chromium.org> X-Mailer: git-send-email 2.33.0.259.gc128427fd7-goog MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH] android: camera_device: Fix crash in calling CameraDevice::close() X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" This fixes the crash when post processing is needed and some capture request is being processed by PipelineHandler upon calling CameraDevice::close(). The crash happens in Request::completeBuffer(), which is invoked by Camera::stop(). It uses FrameBuffer after free. The FrameBuffer is allocated and owned by FrameBufferAllocator, and FrameBufferAllocator is owned by CamerStream. So Camera::stop() should be executed before destroying CameraStream. Signed-off-by: Hirokazu Honda --- src/android/camera_device.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index 8ca76719..74a95a2a 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -423,10 +423,10 @@ int CameraDevice::open(const hw_module_t *hardwareModule) void CameraDevice::close() { - streams_.clear(); - stop(); + streams_.clear(); + camera_->release(); }