[Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything

[Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 1628 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=105368

            Bug ID: 105368
           Summary: Crash in ruvd_end_frame when calling
                    vaBeginPicture/vaEndPicture without rendering anything
           Product: Mesa
           Version: git
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Drivers/Gallium/radeonsi
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: k.philipp@gmail.com
        QA Contact: dri-devel@lists.freedesktop.org

VAAPI testing has revealed that ruvd_end_frame does not handle a particular
edge case (see below), i.e. it crashes.

Source of the crash is here:
https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/radeon/radeon_uvd.c?id=e96e6f60f705c04a3d437eea9fe308826b494c67#n1246

The memset fails when you call vaBeginPicture/vaEndPicture without any relevant
vaRenderPicture calls in-between and have previously decoded some frames using
the context. Then ruvd_begin_frame (triggered by data buffers) is not called to
set up a new bs_ptr, and the old pointer that was unmapped already is still
around, so memset will segfault. Inserting dec->bs_ptr = NULL after the
buffer_unmap works for me, but I don't know if this is the solution or just a
workaround.

ffmpeg seems to do this under certain circumstances, which is how this bug
surfaced. The vaapi documentation does not seem to forbid this, even if it does
not make a lot of sense.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 3174 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 842 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=105368

GitLab Migration User <gitlab-migration@fdo.invalid> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |MOVED

--- Comment #1 from GitLab Migration User <gitlab-migration@fdo.invalid> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/1308.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2571 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel