QCamera2: HAL3: Unmap reprocess input buffers early

Currently reprocess input buffers are unmapped upon JPEG encode
completion. This is problematic because after HAL returns input buffer
after CPP processing, it doesn't own the buffer any more.

The sequence of events leading to the issue:
  1) Reprocess request 1 enters, input buffer FD is N
  2) HAL caches the input buffer
  3) CPP runs on input buffer, returns buffer to framework.
     Cache entry remains. JPEG encoding starts
  4) Framework frees buffer; FD N is now reusable
  5) Reprocess request 2 enters, new buffer also gets FD N
  6) HAL finds buffer in cache
  7) CPP tries to run, but uses stale cache entry, crashes
  8) (if no crash) JPEG encoding completes, cache cleaned up

Bug: 62721870
Test: Camera CTS
Change-Id: I22a06fad9ead03af917e547a9ee4d49d8db2e2d0

2 files changed, 3 insertions, 1 deletions

diff --git a/camera/QCamera2/HAL3/QCamera3Channel.cpp b/camera/QCamera2/HAL3/QCamera3Channel.cpp
index df38002e..e14442e7 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Channel.cpp
@@ -4063,6 +4063,8 @@ void QCamera3ReprocessChannel::streamCbRoutine(mm_camera_super_buf_t *super_fram
         stream->getFrameOffset(offset);
         dumpYUV(frame->bufs[0], dim, offset, QCAMERA_DUMP_FRM_SNAPSHOT);
         /* Since reprocessing is done, send the callback to release the input buffer */
+        // Release offline buffers.
+        obj->releaseOfflineMemory(resultFrameNumber);
         if (mChannelCB) {
             mChannelCB(NULL, NULL, resultFrameNumber, true, mUserData);
         }
diff --git a/camera/QCamera2/HAL3/QCamera3Channel.h b/camera/QCamera2/HAL3/QCamera3Channel.h
index 0528a49d..3c8cb376 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.h
+++ b/camera/QCamera2/HAL3/QCamera3Channel.h
@@ -237,6 +237,7 @@ public:
 
     QCamera3PostProcessor m_postprocessor; // post processor
     void showDebugFPS(int32_t streamType);
+    int32_t releaseOfflineMemory(uint32_t resultFrameNumber);
 
 protected:
     uint8_t mDebugFPS;
@@ -247,7 +248,6 @@ protected:
     void startPostProc(const reprocess_config_t &reproc_cfg);
     void issueChannelCb(buffer_handle_t *resultBuffer,
             uint32_t resultFrameNumber);
-    int32_t releaseOfflineMemory(uint32_t resultFrameNumber);
 
     QCamera3StreamMem mMemory; //output buffer allocated by fwk
     camera3_stream_t *mCamera3Stream;