Camera: Ensure that 'opChanged' can access a valid device instance
'opChanged' callbacks will get registered before the camera3
device initialization. They are not synchronized with the
main service lock and can potentially try to access an invalid
device reference.
Ensure that the 'opChanged' callback registration always happens
after the camera3 device initialization.
Bug: 240725858
Test: Camera CTS
Change-Id: Id3d9877dfafc894cceca5358213f39d5b46a7aee
diff --git a/services/camera/libcameraservice/common/Camera2ClientBase.cpp b/services/camera/libcameraservice/common/Camera2ClientBase.cpp
index 6f43270..f926b88 100644
--- a/services/camera/libcameraservice/common/Camera2ClientBase.cpp
+++ b/services/camera/libcameraservice/common/Camera2ClientBase.cpp
@@ -105,11 +105,6 @@
TClientBase::mCameraIdStr.string());
status_t res;
- // Verify ops permissions
- res = TClientBase::startCameraOps();
- if (res != OK) {
- return res;
- }
IPCTransport providerTransport = IPCTransport::INVALID;
res = providerPtr->getCameraIdIPCTransport(TClientBase::mCameraIdStr.string(),
&providerTransport);
@@ -145,6 +140,14 @@
return res;
}
+ // Verify ops permissions
+ res = TClientBase::startCameraOps();
+ if (res != OK) {
+ TClientBase::finishCameraOps();
+ mDevice.clear();
+ return res;
+ }
+
wp<NotificationListener> weakThis(this);
res = mDevice->setNotifyCallback(weakThis);
if (res != OK) {