[libcamera-devel] [PATCH v3] android: camera_device: Fix crash in calling CameraDevice::close()

[Umang Jain]

Hello,

On 9/1/21 2:34 AM, Laurent Pinchart wrote:
> Hi Hiro,
>
> Thank you for the patch.
>
> On Wed, Sep 01, 2021 at 03:37:39AM +0900, Hirokazu Honda wrote:
>> The problem is happening because we seem to add a CameraStream
>> associated buffer(depending on the CameraStream::Type) to the Request,
> s/(/ (/
>
>> in CameraDevice::processCaptureRequest().
>>
>> However, when the camera stops, all the current buffers are marked with
>> FrameMetadata::FrameCancelled and proceed to completion. But the buffer
>> associated with the CameraStream (that was previously added to the
>> request) has now been cleared out with a part of streams_.clear(), even
>> before the camera stop() has been invoked. Any access to those request
>> buffers after they have been cleared, shall result in a crash.
> s/shall/will/
>
>> Signed-off-by: Hirokazu Honda <hiroh at chromium.org>
> I can fix the above when pushing.
>
> Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>


Reviewed-by: Umang Jain <umang.jain at ideasonboard.com>

>
>> ---
>>   src/android/camera_device.cpp | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp
>> index 8ca76719..fda77db4 100644
>> --- a/src/android/camera_device.cpp
>> +++ b/src/android/camera_device.cpp
>> @@ -423,8 +423,6 @@ int CameraDevice::open(const hw_module_t *hardwareModule)
>>   
>>   void CameraDevice::close()
>>   {
>> -	streams_.clear();
>> -
>>   	stop();
>>   
>>   	camera_->release();
>> @@ -457,6 +455,8 @@ void CameraDevice::stop()
>>   	camera_->stop();
>>   
>>   	descriptors_.clear();
>> +	streams_.clear();
>> +
>>   	state_ = State::Stopped;
>>   }
>>