After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 741381 - rtph264pay: Race condition may cause crash when going from PAUSED->READY
rtph264pay: Race condition may cause crash when going from PAUSED->READY
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-good
git master
Other Linux
: Normal normal
: 1.4.5
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-12-11 09:13 UTC by Patrick Radizi
Modified: 2014-12-12 16:51 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Call parents state change before doing downward state change. (1.34 KB, patch)
2014-12-11 09:28 UTC, Patrick Radizi
committed Details | Review

Description Patrick Radizi 2014-12-11 09:13:56 UTC
There is a thread race condition in rtph264pay which may cause unreffed buffers being used when sending SPS/PPS.

The problem is that the pipeline thread may be running gst_rtp_h264_pay_handle_buffer simultaneously as some other thread is doing a state change which frees global data, rtph264pay->sps/pps, which is being used in handle_buffer.

The result typically looks like this:

GStreamer-CRITICAL **: gst_mini_object_unref: assertion `(g_atomic_int_get
(&mini_object->lockstate) & LOCK_MASK) < 4' failed
Comment 1 Patrick Radizi 2014-12-11 09:28:22 UTC
Created attachment 292513 [details] [review]
Call parents state change before doing downward state change.

Suggested solution based on recommendation from Tim (on IRC)

Call parent state change function before doing the downward state change.
Comment 2 Tim-Philipp Müller 2014-12-12 16:44:24 UTC
Thanks for the patch. Pushed to master:

commit 0a359cdbdce7d85b05582c988831db502793f828
Author: Patrick Radizi <patrickr@axis.com>
Date:   Thu Dec 11 10:16:06 2014 +0100

    rtph264pay: fix potential crash when shutting down
    
    A race condition in the state change function may cause buffers
    to be unreffed while they are still used by the streaming thread
    in gst_rtp_h264_pay_send_sps_pps() resulting in a crash. Chain
    up to the parent class first in the state change function to
    make sure streaming has stopped and only then free those buffers.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=741381


and cherry-picked into 1.4 branch.