summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAbhinav Sohane <asohan@codeaurora.org>2017-09-19 14:26:10 +0530
committerArne Coucheron <arco68@gmail.com>2017-11-26 20:30:12 +0100
commita19b8d9611c463b8ed43a4afdcc411bc8f7d565c (patch)
tree5201d2f86eb181e22e2e8e4927f08338211b90d1
parentefbac9bae0555aed1bbc5140a10ee2e0e9d6c58f (diff)
downloadhardware_lineage_interfaces-lineage-15.0.tar.gz
hardware_lineage_interfaces-lineage-15.0.tar.bz2
hardware_lineage_interfaces-lineage-15.0.zip
Camera:CameraDevice@1.0: Added mutex lock for mMemoryMap.lineage-15.0
Issue: Camera provider crashing due __next_prime overflow while accessing mMemoryMap. Solution: Added mMemoryMapLock for securing mMemoryMap access from multiple threads. Change-Id: I6caa0639a11ff458775a896198bc5a964a5b7a35 CRs-fixed:2068346
-rw-r--r--camera/device/1.0-legacy/CameraDevice.cpp26
-rw-r--r--camera/device/1.0-legacy/CameraDevice_1_0.h2
2 files changed, 23 insertions, 5 deletions
diff --git a/camera/device/1.0-legacy/CameraDevice.cpp b/camera/device/1.0-legacy/CameraDevice.cpp
index 63e5c40..7140ee8 100644
--- a/camera/device/1.0-legacy/CameraDevice.cpp
+++ b/camera/device/1.0-legacy/CameraDevice.cpp
@@ -380,10 +380,13 @@ camera_memory_t* CameraDevice::sGetMemory(int fd, size_t buf_size, uint_t num_bu
hidl_handle hidlHandle = mem->mHidlHandle;
MemoryId id = object->mDeviceCallback->registerMemory(hidlHandle, buf_size, num_bufs);
mem->handle.mId = id;
- if (object->mMemoryMap.count(id) != 0) {
- ALOGE("%s: duplicate MemoryId %d returned by client!", __FUNCTION__, id);
+ {
+ Mutex::Autolock _l(object->mMemoryMapLock);
+ if (object->mMemoryMap.count(id) != 0) {
+ ALOGE("%s: duplicate MemoryId %d returned by client!", __FUNCTION__, id);
+ }
+ object->mMemoryMap[id] = mem;
}
- object->mMemoryMap[id] = mem;
mem->handle.mDevice = object;
return &mem->handle;
}
@@ -401,7 +404,10 @@ void CameraDevice::sPutMemory(camera_memory_t *data) {
ALOGE("%s: camera HAL return memory while camera is not opened!", __FUNCTION__);
}
device->mDeviceCallback->unregisterMemory(mem->handle.mId);
- device->mMemoryMap.erase(mem->handle.mId);
+ {
+ Mutex::Autolock _l(device->mMemoryMapLock);
+ device->mMemoryMap.erase(mem->handle.mId);
+ }
mem->decStrong(mem);
}
@@ -830,7 +836,17 @@ void CameraDevice::releaseRecordingFrameLocked(
return;
}
if (mDevice->ops->release_recording_frame) {
- CameraHeapMemory* camMemory = mMemoryMap.at(memId);
+ CameraHeapMemory* camMemory;
+ {
+ Mutex::Autolock _l(mMemoryMapLock);
+ auto it = mMemoryMap.find(memId);
+ if (it == mMemoryMap.end() || it->second == nullptr) {
+ ALOGE("%s unknown memoryId %d", __FUNCTION__, memId);
+ return;
+ }
+ camMemory = it->second;
+ }
+
if (bufferIndex >= camMemory->mNumBufs) {
ALOGE("%s: bufferIndex %d exceeds number of buffers %d",
__FUNCTION__, bufferIndex, camMemory->mNumBufs);
diff --git a/camera/device/1.0-legacy/CameraDevice_1_0.h b/camera/device/1.0-legacy/CameraDevice_1_0.h
index c078596..a8879d4 100644
--- a/camera/device/1.0-legacy/CameraDevice_1_0.h
+++ b/camera/device/1.0-legacy/CameraDevice_1_0.h
@@ -165,6 +165,8 @@ private:
sp<ICameraDeviceCallback> mDeviceCallback = nullptr;
+ mutable Mutex mMemoryMapLock; // gating access to mMemoryMap
+ // must not hold mLock after this lock is acquired
std::unordered_map<MemoryId, CameraHeapMemory*> mMemoryMap;
bool mMetadataMode = false;