Camera: Avoid invalid member variable access from RequestThread
In case the Camera3Device enters a bad state, the
RequestThread can continue to run after disconnect()
completes. This can potentially cause instabilities
because some of the Camera3Device member variables
will become invalid after disconnect() but are still
accessible in code paths triggered by RequestThread.
Avoid using potentially invalid reference by checking
the respective strong pointer.
Bug: 123293729
Test: Manual using application,
Camera CTS
Change-Id: If3305840db89537593370b7f57bccbb257e49cbd
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index 61665ac..b201119 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -1804,7 +1804,11 @@
// Pause to reconfigure
status_t Camera3Device::internalPauseAndWaitLocked(nsecs_t maxExpectedDuration) {
- mRequestThread->setPaused(true);
+ if (mRequestThread.get() != nullptr) {
+ mRequestThread->setPaused(true);
+ } else {
+ return NO_INIT;
+ }
ALOGV("%s: Camera %s: Internal wait until idle (% " PRIi64 " ns)", __FUNCTION__, mId.string(),
maxExpectedDuration);