QCamera3: Set the gralloc usage of dummy batch stream correctly

A dummy batch video stream is used internally in case clients are
working in constrained operating mode without an actual video stream.
The dummy stream is using exactly the same stream parameters as the
preview which includes the gralloc usage and this will eventually
override the dummy stream type from video to preview. Trying to link
two preview streams with batching enabled in camera backend will
result in failures.
Additionally fix a possible double free of the batched buffer
definitions inside the dummy batched stream. The stream will never
start and as a result stop will not be called as well. However
batched buffer definition will get allocated and en-queued inside the
free batched queue. If we avoid stopping, we also skip flushing any of
the free buffers inside the queue. They will remain in the queue until
the
stream object gets destroyed. The queue flush implementation will try to
release the queue node data which at this point is already freed by the
camera interface layer.

Bug: 70631003
Test: Camera CTS
Change-Id: I9e0c222397a42e51a1343ab17a7285dbc9e1b76d

2 files changed, 5 insertions, 0 deletions

diff --git a/camera/QCamera2/HAL3/QCamera3HWI.cpp b/camera/QCamera2/HAL3/QCamera3HWI.cpp
index c8b5d45a..9068ed58 100644
--- a/camera/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/camera/QCamera2/HAL3/QCamera3HWI.cpp
@@ -2175,6 +2175,7 @@ int QCamera3HardwareInterface::configureStreamsPerfLocked(
                         if (!m_bIsVideo && (streamList->operation_mode ==
                                 CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE)) {
                             mDummyBatchStream = *newStream;
+                            mDummyBatchStream.usage = GRALLOC_USAGE_HW_VIDEO_ENCODER;
                         }
                         channel = new QCamera3RegularChannel(mCameraHandle->camera_handle,
                                 mChannelHandle, mCameraHandle->ops, captureResultCb,
diff --git a/camera/QCamera2/HAL3/QCamera3Stream.cpp b/camera/QCamera2/HAL3/QCamera3Stream.cpp
index 249fa9de..47266943 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Stream.cpp
@@ -1478,6 +1478,10 @@ int32_t QCamera3Stream::putBatchBufs(mm_camera_map_unmap_ops_tbl_t *ops_tbl)
         delete mStreamBatchBufs;
         mStreamBatchBufs = NULL;
     }
+    // Flush any free batch buffers in the queue. The dummy batch stream doesn't
+    // get started, stop will not be able to trigger the flush call making it possible
+    // to free the buffer definitions twice.
+    flushFreeBatchBufQ();
     // mm-camera-interface frees bufDefs even though bufDefs are allocated by
     // QCamera3Stream. Don't free here
     mBatchBufDefs = NULL;