CameraHAL: Fixed accessing deallocated OMX_BUFFERHEADERTYPE

At preview stop step buffers are forced to be flushed from Ducati,
so after OMXCameraAdapter::flushBuffers() no
OMXCameraAdapterFillBufferDone() callback will be triggered afterward.

But because separate thread is used to handle fill buffer done
callbacks flushed buffers will be handled with delay. This causes
the case when already freed buffer header will be accessed.

This patch adds flushing to callbacks thread, waiting until all
flushed buffers from Ducati will be processed before exiting the
OMXCameraAdapter::flushBuffers() body.

This fixes random crashed when looking OMX_OTHER_EXTRADATATYPE in
OMX_TI_PLATFORMPRIVATE buffer header section.

Signed-off-by: Daniel Levin <dendy@ti.com>

Change-Id: I87f9aa3bc4bc02d1e46a4fe2568e063324bc8b79

2 files changed, 42 insertions, 1 deletions

diff --git a/camera/OMXCameraAdapter/OMXCameraAdapter.cpp b/camera/OMXCameraAdapter/OMXCameraAdapter.cpp
index 57ce11a..2eb0eaa 100644
--- a/camera/OMXCameraAdapter/OMXCameraAdapter.cpp
+++ b/camera/OMXCameraAdapter/OMXCameraAdapter.cpp
@@ -1030,6 +1030,8 @@ status_t OMXCameraAdapter::flushBuffers()
         goto EXIT;
         }
 
+    mOMXCallbackHandler->flush();
+
     LOG_FUNCTION_NAME_EXIT;
 
     return (ret | ErrorUtils::omxToAndroidError(eError));
@@ -3442,6 +3444,7 @@ bool OMXCameraAdapter::OMXCallbackHandler::Handler()
         {
         Mutex::Autolock lock(mLock);
         mCommandMsgQ.get(&msg);
+        mIsProcessed = false;
         }
 
         switch ( msg.command ) {
@@ -3458,12 +3461,43 @@ bool OMXCameraAdapter::OMXCallbackHandler::Handler()
                 break;
             }
         }
+
+        {
+            android::AutoMutex locker(mLock);
+            CAMHAL_UNUSED(locker);
+
+            mIsProcessed = mCommandMsgQ.isEmpty();
+            if ( mIsProcessed )
+                mCondition.signal();
+        }
+    }
+
+    // force the condition to wake
+    {
+        android::AutoMutex locker(mLock);
+        CAMHAL_UNUSED(locker);
+
+        mIsProcessed = true;
+        mCondition.signal();
     }
 
     LOG_FUNCTION_NAME_EXIT;
     return false;
 }
 
+void OMXCameraAdapter::OMXCallbackHandler::flush()
+{
+    LOG_FUNCTION_NAME;
+
+    AutoMutex locker(mLock);
+    CAMHAL_UNUSED(locker);
+
+    if ( mIsProcessed )
+        return;
+
+    mCondition.wait(mLock);
+}
+
 OMX_OTHER_EXTRADATATYPE *OMXCameraAdapter::getExtradata(OMX_OTHER_EXTRADATATYPE *extraData, OMX_EXTRADATATYPE type)
 {
   if ( NULL != extraData )
diff --git a/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h b/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
index de22217..fc676b0 100644
--- a/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
+++ b/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
@@ -727,7 +727,10 @@ public:
     class OMXCallbackHandler : public Thread {
         public:
         OMXCallbackHandler(OMXCameraAdapter* ca)
-            : Thread(false), mCameraAdapter(ca) { }
+            : Thread(false), mCameraAdapter(ca)
+        {
+            mIsProcessed = true;
+        }
 
         virtual bool threadLoop() {
             bool ret;
@@ -746,6 +749,8 @@ public:
             mCommandMsgQ.clear();
             }
 
+        void flush();
+
         enum {
             COMMAND_EXIT = -1,
             CAMERA_FILL_BUFFER_DONE,
@@ -756,6 +761,8 @@ public:
         TIUTILS::MessageQueue mCommandMsgQ;
         OMXCameraAdapter* mCameraAdapter;
         Mutex mLock;
+        Condition mCondition;
+        bool mIsProcessed;
     };
 
     sp<OMXCallbackHandler> mOMXCallbackHandler;