From e86358b8afb6cd4cf4b1960bf5a4fda592bfa2e6 Mon Sep 17 00:00:00 2001
From: Emilian Peev <epeev@google.com>
Date: Fri, 15 Feb 2019 13:51:39 -0800
Subject: [PATCH] Camera: Avoid invalid member variable access from
 RequestThread

In case the Camera3Device enters a bad state, the
RequestThread can continue to run after disconnect()
completes. This can potentially cause instabilities
because some of the Camera3Device member variables
will become invalid after disconnect() but are still
accessible in code paths triggered by RequestThread.
Avoid using potentially invalid reference by checking
the respective strong pointer.

Bug: 123293729
Test: Manual using application,
Camera CTS

Change-Id: If3305840db89537593370b7f57bccbb257e49cbd
---
 services/camera/libcameraservice/device3/Camera3Device.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index 61665acc2f..b2011193f1 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -1804,7 +1804,11 @@ void Camera3Device::pauseStateNotify(bool enable) {
 
 // Pause to reconfigure
 status_t Camera3Device::internalPauseAndWaitLocked(nsecs_t maxExpectedDuration) {
-    mRequestThread->setPaused(true);
+    if (mRequestThread.get() != nullptr) {
+        mRequestThread->setPaused(true);
+    } else {
+        return NO_INIT;
+    }
 
     ALOGV("%s: Camera %s: Internal wait until idle (% " PRIi64 " ns)", __FUNCTION__, mId.string(),
           maxExpectedDuration);