Camera: Fix ProviderInfo leak
Having a sp<ProviderInfo> in DeviceInfo resulting in the parent
ProviderInfo not being deallocated.
Test: Check camera characteristics object freed by killing provider
Bug: 149813446
Change-Id: Ic15ffcd3a5ce424187877e17a14b4db581e2c50a
diff --git a/services/camera/libcameraservice/common/CameraProviderManager.cpp b/services/camera/libcameraservice/common/CameraProviderManager.cpp
index 2c97a38..0fd89f1 100644
--- a/services/camera/libcameraservice/common/CameraProviderManager.cpp
+++ b/services/camera/libcameraservice/common/CameraProviderManager.cpp
@@ -326,8 +326,11 @@
// Pass the camera ID to start interface so that it will save it to the map of ICameraProviders
// that are currently in use.
- const sp<provider::V2_4::ICameraProvider> interface =
- deviceInfo->mParentProvider->startProviderInterface();
+ sp<ProviderInfo> parentProvider = deviceInfo->mParentProvider.promote();
+ if (parentProvider == nullptr) {
+ return DEAD_OBJECT;
+ }
+ const sp<provider::V2_4::ICameraProvider> interface = parentProvider->startProviderInterface();
if (interface == nullptr) {
return DEAD_OBJECT;
}
@@ -380,8 +383,11 @@
if (deviceInfo == nullptr) return NAME_NOT_FOUND;
auto *deviceInfo3 = static_cast<ProviderInfo::DeviceInfo3*>(deviceInfo);
- const sp<provider::V2_4::ICameraProvider> provider =
- deviceInfo->mParentProvider->startProviderInterface();
+ sp<ProviderInfo> parentProvider = deviceInfo->mParentProvider.promote();
+ if (parentProvider == nullptr) {
+ return DEAD_OBJECT;
+ }
+ const sp<provider::V2_4::ICameraProvider> provider = parentProvider->startProviderInterface();
if (provider == nullptr) {
return DEAD_OBJECT;
}
@@ -423,8 +429,11 @@
if (deviceInfo == nullptr) return NAME_NOT_FOUND;
auto *deviceInfo1 = static_cast<ProviderInfo::DeviceInfo1*>(deviceInfo);
- const sp<provider::V2_4::ICameraProvider> provider =
- deviceInfo->mParentProvider->startProviderInterface();
+ sp<ProviderInfo> parentProvider = deviceInfo->mParentProvider.promote();
+ if (parentProvider == nullptr) {
+ return DEAD_OBJECT;
+ }
+ const sp<provider::V2_4::ICameraProvider> provider = parentProvider->startProviderInterface();
if (provider == nullptr) {
return DEAD_OBJECT;
}
@@ -2044,7 +2053,10 @@
sp<InterfaceT> device;
ATRACE_CALL();
if (mSavedInterface == nullptr) {
- device = mParentProvider->startDeviceInterface<InterfaceT>(mName);
+ sp<ProviderInfo> parentProvider = mParentProvider.promote();
+ if (parentProvider != nullptr) {
+ device = parentProvider->startDeviceInterface<InterfaceT>(mName);
+ }
} else {
device = (InterfaceT *) mSavedInterface.get();
}
diff --git a/services/camera/libcameraservice/common/CameraProviderManager.h b/services/camera/libcameraservice/common/CameraProviderManager.h
index 1a02980..5359c39 100644
--- a/services/camera/libcameraservice/common/CameraProviderManager.h
+++ b/services/camera/libcameraservice/common/CameraProviderManager.h
@@ -447,7 +447,7 @@
std::map<std::string, hardware::camera::common::V1_0::CameraDeviceStatus>
mPhysicalStatus;
- sp<ProviderInfo> mParentProvider;
+ wp<ProviderInfo> mParentProvider;
bool hasFlashUnit() const { return mHasFlashUnit; }
bool supportNativeZoomRatio() const { return mSupportNativeZoomRatio; }