From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything Date: Tue, 06 Mar 2018 13:01:14 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1585410766==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [131.252.210.165]) by gabe.freedesktop.org (Postfix) with ESMTP id 7D3836E6BA for ; Tue, 6 Mar 2018 13:01:14 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1585410766== Content-Type: multipart/alternative; boundary="15203412740.163e48.22781" Content-Transfer-Encoding: 7bit --15203412740.163e48.22781 Date: Tue, 6 Mar 2018 13:01:14 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D105368 Bug ID: 105368 Summary: Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything Product: Mesa Version: git Hardware: All OS: All Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/radeonsi Assignee: dri-devel@lists.freedesktop.org Reporter: k.philipp@gmail.com QA Contact: dri-devel@lists.freedesktop.org VAAPI testing has revealed that ruvd_end_frame does not handle a particular edge case (see below), i.e. it crashes. Source of the crash is here: https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/radeon/rade= on_uvd.c?id=3De96e6f60f705c04a3d437eea9fe308826b494c67#n1246 The memset fails when you call vaBeginPicture/vaEndPicture without any rele= vant vaRenderPicture calls in-between and have previously decoded some frames us= ing the context. Then ruvd_begin_frame (triggered by data buffers) is not calle= d to set up a new bs_ptr, and the old pointer that was unmapped already is still around, so memset will segfault. Inserting dec->bs_ptr =3D NULL after the buffer_unmap works for me, but I don't know if this is the solution or just= a workaround. ffmpeg seems to do this under certain circumstances, which is how this bug surfaced. The vaapi documentation does not seem to forbid this, even if it = does not make a lot of sense. --=20 You are receiving this mail because: You are the assignee for the bug.= --15203412740.163e48.22781 Date: Tue, 6 Mar 2018 13:01:14 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 105368
Summary Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPict= ure without rendering anything
Product Mesa
Version git
Hardware All
OS All
Status NEW
Severity normal
Priority medium
Component Drivers/Gallium/radeonsi
Assignee dri-devel@lists.freedesktop.org
Reporter k.philipp@gmail.com
QA Contact dri-devel@lists.freedesktop.org 

VAAPI testing has revealed that ruvd_end_frame does not handle=
 a particular
edge case (see below), i.e. it crashes.

Source of the crash is here:
ht=
tps://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/radeon/radeon=
_uvd.c?id=3De96e6f60f705c04a3d437eea9fe308826b494c67#n1246

The memset fails when you call vaBeginPicture/vaEndPicture without any rele=
vant
vaRenderPicture calls in-between and have previously decoded some frames us=
ing
the context. Then ruvd_begin_frame (triggered by data buffers) is not calle=
d to
set up a new bs_ptr, and the old pointer that was unmapped already is still
around, so memset will segfault. Inserting dec->bs_ptr =3D NULL after the
buffer_unmap works for me, but I don't know if this is the solution or just=
 a
workaround.

ffmpeg seems to do this under certain circumstances, which is how this bug
surfaced. The vaapi documentation does not seem to forbid this, even if it =
does
not make a lot of sense.

You are receiving this mail because:
  • You are the assignee for the bug.
= --15203412740.163e48.22781-- --===============1585410766== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1585410766==--