CameraHAL: Removes a possible resource leak inside MemoryManager

- 'mIonFd' doesn't get properly closed in each error case
  involving buffer allocation

Signed-off-by: Emilian Peev <epeev@mm-sol.com>
Signed-off-by: Daniel Levin <x0155538@ti.com>
Signed-off-by: Jean Johnson <a0271255@ti.com>
Signed-off-by: Akwasi Boateng <akwasi.boateng@ti.com>
Signed-off-by: Iliyan Malchev <malchev@google.com>

Change-Id: Ib893e832712e3ea4a3711153453f7a2aa873d0ee

2 files changed, 14 insertions, 8 deletions

diff --git a/camera/MemoryManager.cpp b/camera/MemoryManager.cpp
index 9ce40b9..1333666 100644
--- a/camera/MemoryManager.cpp
+++ b/camera/MemoryManager.cpp
@@ -47,10 +47,10 @@ void* MemoryManager::allocateBuffer(int width, int height, const char* format, i
 {
     LOG_FUNCTION_NAME;
 
-    if(mIonFd == 0)
+    if(mIonFd < 0)
         {
         mIonFd = ion_open();
-        if(mIonFd == 0)
+        if(mIonFd < 0)
             {
             CAMHAL_LOGEA("ion_open failed!!!");
             return NULL;
@@ -66,8 +66,7 @@ void* MemoryManager::allocateBuffer(int width, int height, const char* format, i
     if(!bufsArr)
         {
         CAMHAL_LOGEB("Allocation failed when creating buffers array of %d uint32_t elements", numArrayEntriesC);
-        LOG_FUNCTION_NAME_EXIT;
-        return NULL;
+        goto error;
         }
 
     ///Initialize the array with zeros - this will help us while freeing the array in case of error
@@ -115,13 +114,20 @@ void* MemoryManager::allocateBuffer(int width, int height, const char* format, i
 
 error:
     LOGE("Freeing buffers already allocated after error occurred");
-    freeBuffer(bufsArr);
+    if(bufsArr)
+        freeBuffer(bufsArr);
 
     if ( NULL != mErrorNotifier.get() )
         {
         mErrorNotifier->errorNotify(-ENOMEM);
         }
 
+    if (mIonFd >= 0)
+    {
+        ion_close(mIonFd);
+        mIonFd = -1;
+    }
+
     LOG_FUNCTION_NAME_EXIT;
     return NULL;
 }
@@ -184,10 +190,10 @@ int MemoryManager::freeBuffer(void* buf)
 
     if(mIonBufLength.size() == 0)
         {
-        if(mIonFd)
+        if(mIonFd >= 0)
             {
             ion_close(mIonFd);
-            mIonFd = 0;
+            mIonFd = -1;
             }
         }
     LOG_FUNCTION_NAME_EXIT;
diff --git a/camera/inc/CameraHal.h b/camera/inc/CameraHal.h
index e34f4df..6c3da0a 100644
--- a/camera/inc/CameraHal.h
+++ b/camera/inc/CameraHal.h
@@ -678,7 +678,7 @@ private:
 class MemoryManager : public BufferProvider, public virtual RefBase
 {
 public:
-    MemoryManager():mIonFd(0){ }
+    MemoryManager():mIonFd(-1){ }
 
     ///Initializes the memory manager creates any resources required
     status_t initialize() { return NO_ERROR; }