Camera2/3: Avoid shutdown race in callback processor.
It's possible, during shutdown, for callback processor's heap to be
destroyed when it's about to send the callback back to the user.
Properly copy the heap reference to a local variable before unlocking
the mutex.
Bug: 9485959
Change-Id: I301347b77145f19c7ac721b9127dc74f122acce2
diff --git a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
index 4987ab6..98673ff 100644
--- a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
+++ b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
@@ -365,6 +365,9 @@
ALOGV("%s: Freeing buffer", __FUNCTION__);
mCallbackConsumer->unlockBuffer(imgBuffer);
+
+ // mCallbackHeap may get freed up once input mutex is released
+ callbackHeap = mCallbackHeap;
}
// Call outside parameter lock to allow re-entrancy from notification
@@ -375,7 +378,7 @@
ALOGV("%s: Camera %d: Invoking client data callback",
__FUNCTION__, mId);
l.mRemoteCallback->dataCallback(CAMERA_MSG_PREVIEW_FRAME,
- mCallbackHeap->mBuffers[heapIdx], NULL);
+ callbackHeap->mBuffers[heapIdx], NULL);
}
}