From 1fa4142e1acd4019fe9af890c1285d0c15318c90 Mon Sep 17 00:00:00 2001 From: Avichal Rakesh Date: Fri, 3 Nov 2023 15:33:36 -0700 Subject: [PATCH] ExternalCameraHAL: Fix memory leak when copying buffer fence Pointer to native_handle_t created using native_handle_create should be cleaned up using native_handle_delete even if the fds in the native_handle is no longer managed by it. ExternalCameraDeviceSession creates native_handle_t as an intermediate to convert to AIDL NativeHandle but doesn't call native_handle_delete on the intermediate object which led to memory leaks. This CL removes the intermediate object and copies the fence fd directly. Bug: 305638723 Test: No functional change. Compilation successful. Change-Id: Ie3c558ee1ae6d2e84053b65eed7db179118395bb --- .../default/ExternalCameraDeviceSession.cpp | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/camera/device/default/ExternalCameraDeviceSession.cpp b/camera/device/default/ExternalCameraDeviceSession.cpp index c9629744c2..88e4b75646 100644 --- a/camera/device/default/ExternalCameraDeviceSession.cpp +++ b/camera/device/default/ExternalCameraDeviceSession.cpp @@ -786,9 +786,8 @@ Status ExternalCameraDeviceSession::switchToOffline( outputBuffer.bufferId = buffer.bufferId; outputBuffer.status = BufferStatus::ERROR; if (buffer.acquireFence >= 0) { - native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0); - handle->data[0] = buffer.acquireFence; - outputBuffer.releaseFence = android::makeToAidl(handle); + outputBuffer.releaseFence.fds.resize(1); + outputBuffer.releaseFence.fds.at(0).set(buffer.acquireFence); } } else { offlineBuffers.push_back(buffer); @@ -1769,9 +1768,8 @@ Status ExternalCameraDeviceSession::processCaptureRequestError( result.outputBuffers[i].bufferId = req->buffers[i].bufferId; result.outputBuffers[i].status = BufferStatus::ERROR; if (req->buffers[i].acquireFence >= 0) { - native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0); - handle->data[0] = req->buffers[i].acquireFence; - result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle); + result.outputBuffers[i].releaseFence.fds.resize(1); + result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence); } } @@ -1815,18 +1813,16 @@ Status ExternalCameraDeviceSession::processCaptureResult(std::shared_ptrbuffers[i].fenceTimeout) { result.outputBuffers[i].status = BufferStatus::ERROR; if (req->buffers[i].acquireFence >= 0) { - native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0); - handle->data[0] = req->buffers[i].acquireFence; - result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle); + result.outputBuffers[i].releaseFence.fds.resize(1); + result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence); } notifyError(req->frameNumber, req->buffers[i].streamId, ErrorCode::ERROR_BUFFER); } else { result.outputBuffers[i].status = BufferStatus::OK; // TODO: refactor if (req->buffers[i].acquireFence >= 0) { - native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0); - handle->data[0] = req->buffers[i].acquireFence; - result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle); + result.outputBuffers[i].releaseFence.fds.resize(1); + result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence); } } }