commit 5562b8c7f41755d0d8d23e24179fc95e4417be51
author Emilian Peev <epeev@google.com> Thu Jul 27 18:57:26 2017 +0100
committer Emilian Peev <epeev@google.com> Tue Aug 01 15:21:53 2017 +0100
tree 3cb7ac4aeb19a54631f49a5db4bffe6ed2cc8078
parent f85755bf10bade33efef141d40f4c96029b9839c

QCamera2: HAL3: Synchronize access to offline buffers

"mOfflineMetaBuffers" and "mOfflineBuffers" can be modified
by two threads at the same leading to crashes. To avoid this
serialize the access by using an additional mutex.

Bug: 64194071
Test: Camera CTS
Change-Id: I358a1412e944084d4a54f3cdd9aa4a7eb08e8a95

camera/QCamera2/HAL3/QCamera3Channel.cpp

diff --git a/camera/QCamera2/HAL3/QCamera3Channel.cpp b/camera/QCamera2/HAL3/QCamera3Channel.cpp
index 8bd1deb..dcc94b5 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Channel.cpp
@@ -4330,6 +4330,7 @@
 int32_t QCamera3ReprocessChannel::unmapOfflineBuffers(bool all)
 {
     int rc = NO_ERROR;
+    Mutex::Autolock l(mOfflineBuffersLock);
     if (!mOfflineBuffers.empty()) {
         QCamera3Stream *stream = NULL;
         List<OfflineBuffer>::iterator it = mOfflineBuffers.begin();
@@ -4738,6 +4739,7 @@
             frame->input_buffer.fd, frame->input_buffer.buffer,
             frame->input_buffer.frame_len);
     if (NO_ERROR == rc) {
+        Mutex::Autolock l(mOfflineBuffersLock);
         mappedBuffer.index = buf_idx;
         mappedBuffer.stream = pStream;
         mappedBuffer.type = CAM_MAPPING_BUF_TYPE_OFFLINE_INPUT_BUF;
@@ -4758,6 +4760,7 @@
             frame->metadata_buffer.fd, frame->metadata_buffer.buffer,
             frame->metadata_buffer.frame_len);
     if (NO_ERROR == rc) {
+        Mutex::Autolock l(mOfflineBuffersLock);
         mappedBuffer.index = meta_buf_idx;
         mappedBuffer.stream = pStream;
         mappedBuffer.type = CAM_MAPPING_BUF_TYPE_OFFLINE_META_BUF;

camera/QCamera2/HAL3/QCamera3Channel.h

diff --git a/camera/QCamera2/HAL3/QCamera3Channel.h b/camera/QCamera2/HAL3/QCamera3Channel.h
index 3c8cb37..dca7c9f 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.h
+++ b/camera/QCamera2/HAL3/QCamera3Channel.h
@@ -599,6 +599,7 @@
     } OfflineBuffer;
 
     int32_t resetToCamPerfNormal(uint32_t frameNumber);
+    Mutex mOfflineBuffersLock; // Lock for offline buffers
     android::List<OfflineBuffer> mOfflineBuffers;
     android::List<OfflineBuffer> mOfflineMetaBuffers;
     int32_t mOfflineBuffersIndex;