[Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything - bugzilla-daemon

From: bugzilla-daemon@freedesktop.org
To: dri-devel@lists.freedesktop.org
Subject: [Bug 105368] Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
Date: Tue, 06 Mar 2018 13:01:14 +0000	[thread overview]
Message-ID: <bug-105368-502@http.bugs.freedesktop.org/> (raw)

[-- Attachment #1.1: Type: text/plain, Size: 1628 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=105368

            Bug ID: 105368
           Summary: Crash in ruvd_end_frame when calling
                    vaBeginPicture/vaEndPicture without rendering anything
           Product: Mesa
           Version: git
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Drivers/Gallium/radeonsi
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: k.philipp@gmail.com
        QA Contact: dri-devel@lists.freedesktop.org

VAAPI testing has revealed that ruvd_end_frame does not handle a particular
edge case (see below), i.e. it crashes.

Source of the crash is here:
https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/radeon/radeon_uvd.c?id=e96e6f60f705c04a3d437eea9fe308826b494c67#n1246

The memset fails when you call vaBeginPicture/vaEndPicture without any relevant
vaRenderPicture calls in-between and have previously decoded some frames using
the context. Then ruvd_begin_frame (triggered by data buffers) is not called to
set up a new bs_ptr, and the old pointer that was unmapped already is still
around, so memset will segfault. Inserting dec->bs_ptr = NULL after the
buffer_unmap works for me, but I don't know if this is the solution or just a
workaround.

ffmpeg seems to do this under certain circumstances, which is how this bug
surfaced. The vaapi documentation does not seem to forbid this, even if it does
not make a lot of sense.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 3174 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel