From f6807016a37fc11f8c93f105569f04fa1a2326e7 Mon Sep 17 00:00:00 2001
From: Hirokazu Honda <hiroh@chromium.org>
Date: Wed, 1 Dec 2021 16:53:46 +0900
Subject: android: camera_device: Fix variables access without protection

This fixes the code accessing descriptors and
Camera3RequestDescriptor::pendingStreamsToProcess_ without holding
descriptorsMutex_ and Camera3RequestDescriptor::streamProcessMutex_
in CameraDevice.

Signed-off-by: Hirokazu Honda <hiroh@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
---
 src/android/camera_device.cpp | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'src/android/camera_device.cpp')

diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp
index c7686557..db400e74 100644
--- a/src/android/camera_device.cpp
+++ b/src/android/camera_device.cpp
@@ -436,7 +436,11 @@ void CameraDevice::stop()
 	worker_.stop();
 	camera_->stop();
 
-	descriptors_ = {};
+	{
+		MutexLocker descriptorsLock(descriptorsMutex_);
+		descriptors_ = {};
+	}
+
 	streams_.clear();
 
 	state_ = State::Stopped;
@@ -933,6 +937,9 @@ int CameraDevice::processCaptureRequest(camera3_capture_request_t *camera3Reques
 		 */
 		FrameBuffer *frameBuffer = nullptr;
 		int acquireFence = -1;
+
+		MutexLocker lock(descriptor->streamsProcessMutex_);
+
 		switch (cameraStream->type()) {
 		case CameraStream::Type::Mapped:
 			/*
-- 
cgit v1.2.1