diff options
author | Eino-Ville Talvala <etalvala@google.com> | 2013-06-19 08:42:17 -0700 |
---|---|---|
committer | Eino-Ville Talvala <etalvala@google.com> | 2013-06-19 08:42:17 -0700 |
commit | e6478de72a8ae1d3abb3e8c20898977c45354a4f (patch) | |
tree | 9a4d51e3ba03c3d4de9d43598f32e9961e6d0fe0 /services | |
parent | 241b52798809d8db3d369af05ace1f73f723f29b (diff) | |
download | frameworks_av-e6478de72a8ae1d3abb3e8c20898977c45354a4f.zip frameworks_av-e6478de72a8ae1d3abb3e8c20898977c45354a4f.tar.gz frameworks_av-e6478de72a8ae1d3abb3e8c20898977c45354a4f.tar.bz2 |
Camera2/3: Avoid shutdown race in callback processor.
It's possible, during shutdown, for callback processor's heap to be
destroyed when it's about to send the callback back to the user.
Properly copy the heap reference to a local variable before unlocking
the mutex.
Bug: 9485959
Change-Id: I301347b77145f19c7ac721b9127dc74f122acce2
Diffstat (limited to 'services')
-rw-r--r-- | services/camera/libcameraservice/camera2/CallbackProcessor.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp index 4987ab6..98673ff 100644 --- a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp +++ b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp @@ -365,6 +365,9 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) { ALOGV("%s: Freeing buffer", __FUNCTION__); mCallbackConsumer->unlockBuffer(imgBuffer); + + // mCallbackHeap may get freed up once input mutex is released + callbackHeap = mCallbackHeap; } // Call outside parameter lock to allow re-entrancy from notification @@ -375,7 +378,7 @@ status_t CallbackProcessor::processNewCallback(sp<Camera2Client> &client) { ALOGV("%s: Camera %d: Invoking client data callback", __FUNCTION__, mId); l.mRemoteCallback->dataCallback(CAMERA_MSG_PREVIEW_FRAME, - mCallbackHeap->mBuffers[heapIdx], NULL); + callbackHeap->mBuffers[heapIdx], NULL); } } |