QCamera2: HAL3: Unmap reprocess input buffers early

Currently reprocess input buffers are unmapped upon JPEG encode
completion. This is problematic because after HAL returns input buffer
after CPP processing, it doesn't own the buffer any more.

The sequence of events leading to the issue:
  1) Reprocess request 1 enters, input buffer FD is N
  2) HAL caches the input buffer
  3) CPP runs on input buffer, returns buffer to framework.
     Cache entry remains. JPEG encoding starts
  4) Framework frees buffer; FD N is now reusable
  5) Reprocess request 2 enters, new buffer also gets FD N
  6) HAL finds buffer in cache
  7) CPP tries to run, but uses stale cache entry, crashes
  8) (if no crash) JPEG encoding completes, cache cleaned up

Bug: 62721870
Test: Camera CTS
Change-Id: I22a06fad9ead03af917e547a9ee4d49d8db2e2d0

2 files changed, 3 insertions, 1 deletions

diff --git a/camera/QCamera2/HAL3/QCamera3Channel.cpp b/camera/QCamera2/HAL3/QCamera3Channel.cpp
index efbf107..cb31953 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Channel.cpp
@@ -3571,6 +3571,8 @@ void QCamera3ReprocessChannel::streamCbRoutine(mm_camera_super_buf_t *super_fram
         *frame = *super_frame;
 
         /* Since reprocessing is done, send the callback to release the input buffer */
+        // Release offline buffers.
+        obj->releaseOfflineMemory(resultFrameNumber);
         if (mChannelCB) {
             mChannelCB(NULL, NULL, resultFrameNumber, true, mUserData);
         }
diff --git a/camera/QCamera2/HAL3/QCamera3Channel.h b/camera/QCamera2/HAL3/QCamera3Channel.h
index 3bf4125..b1edece 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.h
+++ b/camera/QCamera2/HAL3/QCamera3Channel.h
@@ -198,13 +198,13 @@ public:
     int32_t getStreamSize(cam_dimension_t &dim);
 
     QCamera3PostProcessor m_postprocessor; // post processor
+    int32_t releaseOfflineMemory(uint32_t resultFrameNumber);
 
 protected:
     bool isWNREnabled() {return m_bWNROn;};
     void startPostProc(const reprocess_config_t &reproc_cfg);
     void issueChannelCb(buffer_handle_t *resultBuffer,
             uint32_t resultFrameNumber);
-    int32_t releaseOfflineMemory(uint32_t resultFrameNumber);
 
     QCamera3StreamMem mMemory; //output buffer allocated by fwk
     camera3_stream_t *mCamera3Stream;