Camera2/3: Avoid shutdown race in callback processor.

It's possible, during shutdown, for callback processor's heap to be
destroyed when it's about to send the callback back to the user.
Properly copy the heap reference to a local variable before unlocking
the mutex.

Bug: 9485959
Change-Id: I301347b77145f19c7ac721b9127dc74f122acce2

1 files changed, 4 insertions, 1 deletions

diff --git a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
index 4987ab6..98673ff 100644
--- a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
+++ b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
@@ -365,6 +365,9 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) {
 
         ALOGV("%s: Freeing buffer", __FUNCTION__);
         mCallbackConsumer->unlockBuffer(imgBuffer);
+
+        // mCallbackHeap may get freed up once input mutex is released
+        callbackHeap = mCallbackHeap;
     }
 
     // Call outside parameter lock to allow re-entrancy from notification
@@ -375,7 +378,7 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) {
             ALOGV("%s: Camera %d: Invoking client data callback",
                     __FUNCTION__, mId);
             l.mRemoteCallback->dataCallback(CAMERA_MSG_PREVIEW_FRAME,
-                    mCallbackHeap->mBuffers[heapIdx], NULL);
+                    callbackHeap->mBuffers[heapIdx], NULL);
         }
     }