After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 737110 - rtsp-client: race condition when closing client connection
rtsp-client: race condition when closing client connection
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-rtsp-server
git master
Other Linux
: Normal normal
: 1.5.1
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-09-22 11:46 UTC by Ognyan Tonchev (redstar_)
Modified: 2014-09-24 10:41 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
rtsp-client: do not free main context before rtsp watch (1.20 KB, patch)
2014-09-22 11:46 UTC, Ognyan Tonchev (redstar_)
committed Details | Review

Description Ognyan Tonchev (redstar_) 2014-09-22 11:46:51 UTC
Created attachment 286804 [details] [review]
rtsp-client: do not free main context before rtsp watch

There is a rare race condition which can lead to a crash when closing the connection. The problem is basically that the clients main context can be freed before/while the rtsp watch is destroyed:

gst_rtsp_client_close () drops all references to the rtsp watch by calling g_source_destroy() and g_source_unref(). Which on the other hand will trigger GLib to call the GSource finalize function, client_watch_notify().

client_watch_notify() drops the ref to the main context owned by the client object and emits the CLOSED signal.

This will result in a call to unmanage_client() in the server object.
unmanage_client() adds an idle source which among other things will drop the last ref to the client main context.

Most of the time the idle source is scheduled after client_watch_notify() returns and g_source_unref_internal () has finished using the context mutex. But the source can also be dispatched while g_source_unref_internal () is still not done.
Comment 1 Sebastian Dröge (slomo) 2014-09-24 07:42:58 UTC
commit 17f5785638edd7af241dc028ccb91331498b2cfb
Author: Ognyan Tonchev <ognyan@axis.com>
Date:   Mon Sep 22 13:32:06 2014 +0200

    rtsp-client: do not free main context before rtsp watch
    
    https://bugzilla.gnome.org/show_bug.cgi?id=737110