[libcamera-devel] [PATCH] pipeline: raspberrypi: Fix a bug when clearing out Request buffers on stop

[David Plowman]

Hi Naush

Thank you very much for fixing this!

On Wed, 21 Jul 2021 at 10:28, Naushir Patuck <naush at raspberrypi.com> wrote:
>
> When RPiCameraData::clearIncompleteRequests() clears out the request queue
> during a stop condition, it unconditionally calls completeBuffer() on all
> buffers in each request.  This is wrong, as a buffer could have already been
> completed as part of the current request, but the request itself may not yet
> have completed.
>
> Fix this by checking if the buffers in the request have been completed before
> cancelling them.
>
> Fixes: d372aaa10ddb ("pipeline: raspberrypi: Simplify RPiCameraData::clearIncompleteRequests()")
> Signed-off-by: Naushir Patuck <naush at raspberrypi.com>

I've been trying this patch out and it has indeed fixed the crash I
was experiencing.

Tested-by: David Plowman <david.plowman at raspberrypi.com>
Reviewed-by: David Plowman <david.plowman at raspberrypi.com>

Thanks!
David

> ---
>  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> index f821d8fe1b6c..0bab3bedd402 100644
> --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> @@ -1520,8 +1520,14 @@ void RPiCameraData::clearIncompleteRequests()
>
>                 for (auto &b : request->buffers()) {
>                         FrameBuffer *buffer = b.second;
> -                       buffer->cancel();
> -                       pipe_->completeBuffer(request, buffer);
> +                       /*
> +                        * Has the buffer already been handed back to the
> +                        * request? If not, do so now.
> +                        */
> +                       if (buffer->request()) {
> +                               buffer->cancel();
> +                               pipe_->completeBuffer(request, buffer);
> +                       }
>                 }
>
>                 pipe_->completeRequest(request);
> --
> 2.25.1
>