Camera: fix status tracker race condition
Request thread may race with disconnect call when device is
disconnected in error condition. Acquire mLock when camera
device is updating status tracker to prevent that race
(status tracker being freed and then updated).
In other places where status tracker is updated, there is
a promoted sp to guarantee status tracker remain alive during
the call.
Test: CTS, manual camera testing
Bug: 62420820
Change-Id: Id894b5d3482c64125c114f79dbe746c56048fcbe
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index a11f4e2..499bc86 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -2326,7 +2326,11 @@
if (res < 0) return res;
if (mInFlightMap.size() == 1) {
- mStatusTracker->markComponentActive(mInFlightStatusId);
+ // hold mLock to prevent race with disconnect
+ Mutex::Autolock l(mLock);
+ if (mStatusTracker != nullptr) {
+ mStatusTracker->markComponentActive(mInFlightStatusId);
+ }
}
return OK;
@@ -2353,7 +2357,11 @@
// Indicate idle inFlightMap to the status tracker
if (mInFlightMap.size() == 0) {
- mStatusTracker->markComponentIdle(mInFlightStatusId, Fence::NO_FENCE);
+ // hold mLock to prevent race with disconnect
+ Mutex::Autolock l(mLock);
+ if (mStatusTracker != nullptr) {
+ mStatusTracker->markComponentIdle(mInFlightStatusId, Fence::NO_FENCE);
+ }
}
}