CameraHAL: Adds locking when accessing 'mFocusAreas'

- This is due to the access pattern of 'mFocusAreas.
  Currently both 'setFocusMode()' and
  'setParametersFocus()' can in parallel try to
  write/read from this Vector. A race condition is
  possible, in which the former method can clear a
  focus area, while the latter method is trying to
  increment its strong pointer. This will inevitably
  result in a segfault.

Change-Id: I0e94d18326b85c20f73296d31d980b9c39685c32
Original-author: Emilian Peev <epeev@mm-sol.com>
Signed-off-by: Emilian Peev <epeev@mm-sol.com>
Signed-off-by: Tyler Luu <tluu@ti.com>

3 files changed, 8 insertions, 3 deletions

diff --git a/camera/OMXCameraAdapter/OMX3A.cpp b/camera/OMXCameraAdapter/OMX3A.cpp
index 647c7a7..54e8b8f 100644
--- a/camera/OMXCameraAdapter/OMX3A.cpp
+++ b/camera/OMXCameraAdapter/OMX3A.cpp
@@ -396,11 +396,14 @@ status_t OMXCameraAdapter::setFocusMode(Gen3A_settings& Gen3A)
         return NO_INIT;
         }
 
-    if ( !mFocusAreas.isEmpty() )
         {
-        focusArea = mFocusAreas.itemAt(0);
-        }
+        Mutex::Autolock lock(mFocusAreasLock);
 
+        if ( !mFocusAreas.isEmpty() )
+            {
+            focusArea = mFocusAreas.itemAt(0);
+            }
+        }
 
     ///Face detection takes precedence over touch AF
     if ( mFaceDetectionRunning )
diff --git a/camera/OMXCameraAdapter/OMXFocus.cpp b/camera/OMXCameraAdapter/OMXFocus.cpp
index f12b85c..ae5366b 100644
--- a/camera/OMXCameraAdapter/OMXFocus.cpp
+++ b/camera/OMXCameraAdapter/OMXFocus.cpp
@@ -40,6 +40,7 @@ status_t OMXCameraAdapter::setParametersFocus(const CameraParameters &params,
 {
     status_t ret = NO_ERROR;
     const char *str = NULL;
+    Mutex::Autolock lock(mFocusAreasLock);
 
     LOG_FUNCTION_NAME;
 
diff --git a/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h b/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
index d85bc4f..ef3d6a0 100644
--- a/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
+++ b/camera/inc/OMXCameraAdapter/OMXCameraAdapter.h
@@ -725,6 +725,7 @@ private:
 
     // Current Focus areas
     Vector< sp<CameraArea> > mFocusAreas;
+    mutable Mutex mFocusAreasLock;
 
     CaptureMode mCapMode;
     size_t mBurstFrames;