After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 736041 - Protect rtsp transport data.
Protect rtsp transport data.
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-rtsp-server
unspecified
Other Linux
: Normal normal
: 1.5.1
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-09-04 11:24 UTC by Göran Jönsson
Modified: 2014-09-16 08:48 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
gst-rtsp-server patch (7.84 KB, patch)
2014-09-04 11:24 UTC, Göran Jönsson
none Details | Review
gst-rtsp-server patch (7.57 KB, patch)
2014-09-05 07:12 UTC, Göran Jönsson
needs-work Details | Review
gst-rtsp-server patch (7.43 KB, patch)
2014-09-09 05:31 UTC, Göran Jönsson
rejected Details | Review

Description Göran Jönsson 2014-09-04 11:24:51 UTC
Created attachment 285349 [details] [review]
gst-rtsp-server patch

Fix a crash.

possible for more than one thread to manipulate rtsp transports data.
Comment 1 Sebastian Dröge (slomo) 2014-09-04 11:31:55 UTC
Why is a recursive mutex needed here?
Comment 2 Göran Jönsson 2014-09-04 12:13:01 UTC
This is necessary because some functions in rtsp-stream-transport.c is calling other functions in rtsp-stream-transport.c .

An exampel 
If calling gst_rtsp_stream_transport_set_active ( take mutex )
this is calling  update_transport
that is calling gst_rtsp_stream_transport_get_transport ( take mutex )
Comment 3 Sebastian Dröge (slomo) 2014-09-04 12:19:43 UTC
Maybe there should be internal versions of those functions that don't take the mutexes then
Comment 4 Göran Jönsson 2014-09-05 07:12:34 UTC
Created attachment 285454 [details] [review]
gst-rtsp-server patch

New patch
Comment 5 Wim Taymans 2014-09-05 09:32:30 UTC
- do the notifies outside of the lock
- gst_rtsp_stream_transport_get_stream() does it need the lock? it can never change after creating the transport.
- callback such as send_rtp, send_rtcp, keep_alive should be done outside of the 
lock, if possible.
Comment 6 Göran Jönsson 2014-09-09 05:31:09 UTC
Created attachment 285710 [details] [review]
gst-rtsp-server patch

New patch

- callback such as send_rtp, send_rtcp, keep_alive should be done outside of
the 
lock, if possible.

This is not possible, this is what happens for us.

Thread 4 (Thread 21491)

  • #0 do_send_data
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c line 704
  • #1 handle_new_sample
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c line 1489
  • #2 gst_app_sink_render
    at /home/goranjn/20140902/libs/gst-plugins-base/gst-plugins-base/gst-libs/gst/app/gstappsink.c line 751
  • #3 gst_base_sink_chain_unlocked
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c line 3378
  • #4 gst_base_sink_chain_main
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c line 3486
  • #5 gst_pad_chain_data_unchecked
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpad.c line 3766
  • #6 gst_pad_push_data
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpad.c line 3996
  • #7 gst_queue_push_one
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/plugins/elements/gstqueue.c line 1120
  • #8 gst_queue_loop
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/plugins/elements/gstqueue.c line 1249
  • #9 gst_task_func
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gsttask.c line 316
  • #10 g_thread_pool_thread_proxy
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthreadpool.c line 309
  • #11 g_thread_proxy
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread.c line 798
  • #12 start_thread
    at pthread_create.c line 310
  • #13 __thread_start
    from target/mipsisa32r2el-axis-linux-gnu/lib/libc.so.6

Thread 11 (Thread 21417)

  • #0 __lll_lock_wait
    at ../nptl/sysdeps/unix/sysv/linux/lowlevellock.c line 46
  • #1 __pthread_mutex_lock
    at pthread_mutex_lock.c line 108
  • #2 g_mutex_lock
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread-posix.c line 210
  • #3 gst_base_sink_change_state
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c line 4941
  • #4 gst_element_change_state
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c line 2602
  • #5 gst_element_set_state_func
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c line 2558
  • #6 gst_bin_element_set_state
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstbin.c line 2325
  • #7 gst_bin_change_state_func
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstbin.c line 2648
  • #8 gst_pipeline_change_state
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpipeline.c line 471
  • #9 gst_element_change_state
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c line 2602
  • #10 gst_element_set_state_func
    at /home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c line 2558
  • #11 media_set_pipeline_state_locked
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-media.c line 2911
  • #12 gst_rtsp_media_set_state
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-media.c line 3027
  • #13 gst_rtsp_session_media_set_state
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-session-media.c line 453
  • #14 handle_pause_request
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c line 1090
  • #15 handle_request
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c line 2216
  • #16 gst_rtsp_client_handle_message
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c line 2781
  • #17 gst_rtsp_source_dispatch_read
    at /home/goranjn/20140902/libs/gst-plugins-base/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c line 3141
  • #18 g_main_dispatch
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c line 3061
  • #19 g_main_context_dispatch
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c line 3637
  • #20 g_main_context_iterate
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c line 3708
  • #21 g_main_loop_run
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c line 3902
  • #22 do_loop
    at /home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-thread-pool.c line 329
  • #23 g_thread_pool_thread_proxy
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthreadpool.c line 309
  • #24 g_thread_proxy
    at /home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread.c line 798
  • #25 start_thread
    at pthread_create.c line 310
  • #26 __thread_start
    from target/mipsisa32r2el-axis-linux-gnu/lib/libc.so.6

The do_send_data( send_rtp callback ) is crash because the client is NULL. And if we look at thread 11 f #13 and f #14  we can see that 
unlink_session_transports (client, session, sessmedia) is called just before  gst_rtsp_session_media_set_state.

The unlink_session_transports have been called the function unlink_transport ( this is tcp case ) that have called the
gst_rtsp_stream_transport_set_callbacks (trans, NULL, NULL, NULL, NULL);

So the mutex have to protect the callbacks and userdata.
Comment 7 Wim Taymans 2014-09-09 11:24:26 UTC
The problem is in how this code is structured. There is no locking in stream_transport because it is all supposed to be locked from the stream and media objects.

Adding those locks is rather pointless because the objects (transport, url) are not refcounted outside of the locks.

Adding a lock around the function call is usually done with a recursive mutex. This would add overhead, I think I have a better idea by restructuring the code a little. Let me propose another patch.
Comment 8 Wim Taymans 2014-09-09 16:18:44 UTC
I'm thinking of redoing things differently here:

http://cgit.freedesktop.org/~wtay/gst-rtsp-server/log/?h=transport-simplify
Comment 9 Göran Jönsson 2014-09-10 11:13:06 UTC
I tested with patches. 

client: simplify session transport handlingtransport-simplify
stream-transport: make method to handle received data
 
And that have solved our problem.
Comment 10 Sebastian Dröge (slomo) 2014-09-12 12:48:13 UTC
Wim, are those changes ready to be merged?
Comment 11 Wim Taymans 2014-09-16 08:48:38 UTC
commit 0292be09eaf338f16c752aee0c317b1e6b3971e2
Author: Wim Taymans <wtaymans@redhat.com>
Date:   Tue Sep 9 18:11:39 2014 +0200

    client: simplify session transport handling
    
    link/unlink of the transport in a session was done to keep track of all
    TCP transports and to send RTP/RTCP data to the streams. We can simplify
    that by putting all the TCP transports in a hashtable indexed with the
    channel number.
    
    We also don't need to link/unlink the transports when we pause/resume
    the streams. The same effect is already achieved when we pause/play the
    media. Indeed, when we pause the media, the transport is removed from
    the media and the callbacks will not be called anymore.
    
    See https://bugzilla.gnome.org/show_bug.cgi?id=736041

commit ea5d4cfc7e29d010c0d7b6a2f606de76a6d117f4
Author: Wim Taymans <wtaymans@redhat.com>
Date:   Tue Sep 9 18:10:12 2014 +0200

    stream-transport: make method to handle received data
    
    Make a method to handle the data received on a channel. It sends the
    data to the stream of the transport on the RTP or RTCP pads based on
    the channel number.