Camera3Device: Close hole in prepare in-use stream check

There's a narrow window in which a capture request is neither in the
request queue or handed off to the HAL, which can be expanded to some
size if buffers have to be allocated.  During this window, the
prepare() method will not correctly notice that a stream should be
considered in use.

Add a member to contain the current request being processed, and check
against it in prepare as well.

Change-Id: I3a198d617f5feee0a3332af4b4439f24eda28ea3

2 files changed, 22 insertions, 0 deletions

diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index 445c9c2..e2a53a2 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -2865,6 +2865,12 @@ bool Camera3Device::RequestThread::threadLoop() {
         nextRequest->mSettings.unlock(request.settings);
     }
 
+    // Unset as current request
+    {
+        Mutex::Autolock l(mRequestLock);
+        mNextRequest.clear();
+    }
+
     // Remove any previously queued triggers (after unlock)
     res = removeTriggers(mPrevRequest);
     if (res != OK) {
@@ -2890,6 +2896,13 @@ bool Camera3Device::RequestThread::isStreamPending(
         sp<Camera3StreamInterface>& stream) {
     Mutex::Autolock l(mRequestLock);
 
+    if (mNextRequest != nullptr) {
+        for (const auto& s : mNextRequest->mOutputStreams) {
+            if (stream == s) return true;
+        }
+        if (stream == mNextRequest->mInputStream) return true;
+    }
+
     for (const auto& request : mRequestQueue) {
         for (const auto& s : request->mOutputStreams) {
             if (stream == s) return true;
@@ -2924,6 +2937,9 @@ void Camera3Device::RequestThread::cleanUpFailedRequest(
         nextRequest->mOutputStreams.editItemAt(i)->returnBuffer(
             outputBuffers[i], 0);
     }
+
+    Mutex::Autolock l(mRequestLock);
+    mNextRequest.clear();
 }
 
 sp<Camera3Device::CaptureRequest>
@@ -3007,6 +3023,8 @@ sp<Camera3Device::CaptureRequest>
         nextRequest->mResultExtras.afTriggerId = mCurrentAfTriggerId;
         nextRequest->mResultExtras.precaptureTriggerId = mCurrentPreCaptureTriggerId;
     }
+    mNextRequest = nextRequest;
+
     return nextRequest;
 }
 
diff --git a/services/camera/libcameraservice/device3/Camera3Device.h b/services/camera/libcameraservice/device3/Camera3Device.h
index 4fbcb2e..fcb5180 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.h
+++ b/services/camera/libcameraservice/device3/Camera3Device.h
@@ -501,6 +501,10 @@ class Camera3Device :
         Condition          mRequestSignal;
         RequestList        mRequestQueue;
         RequestList        mRepeatingRequests;
+        // The next request being prepped for submission to the HAL, no longer
+        // on the request queue. Read-only even with mRequestLock held, outside
+        // of threadLoop
+        sp<const CaptureRequest> mNextRequest;
 
         bool               mReconfigured;