mirror of
https://gitlab.freedesktop.org/gstreamer/gstreamer.git
synced 2024-12-24 01:00:37 +00:00
acd40e7852
When we're doing a state change from PLAYING to NULL, first we invoke gst_rtspsrc_loop_send_cmd_and_wait (..., CMD_CLOSE, ...) during PAUSED_TO_READY which will schedule a TEARDOWN to happen async on the task thread. The task thread will call gst_rtspsrc_close(), which will send the TEARDOWN and once it's complete, it will call gst_rtspsrc_cleanup() without taking any locks, which frees src->streams. At the same time however, the state change in the app thread will progress further and in READY_TO_NULL it will call gst_rtspsrc_stop() which calls gst_rtspsrc_close() a second time, which accesses src->streams (without a lock again), which leads to simultaneous access of src->streams, and a segfault. So the state change and the cleanup are racing, but they almost always complete sequentially. Either the cleanup sets src->streams to NULL or _stop() completes first. Very rarely, _stop() can start while src->streams is being freed in a for loop. That causes the segfault. This is unlocked access is unfixable with more locking, it just leads to deadlocks. This pattern has been observed in rtspsrc a lot: state changes and cleanup in the element are unfixably racy, and that foundational issue is being addressed separately via a rewrite. The bandage fix here is to prevent gst_rtspsrc_stop() from accessing src->streams after it has already been freed by setting src->state to INVALID. Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/6346> |
||
|---|---|---|
| .. | ||
| gst-devtools | ||
| gst-docs | ||
| gst-editing-services | ||
| gst-examples | ||
| gst-integration-testsuites | ||
| gst-libav | ||
| gst-omx | ||
| gst-plugins-bad | ||
| gst-plugins-base | ||
| gst-plugins-good | ||
| gst-plugins-ugly | ||
| gst-python | ||
| gst-rtsp-server | ||
| gstreamer | ||
| gstreamer-sharp | ||
| gstreamer-vaapi | ||
| macos-bison-binary | ||
| packagefiles | ||
| win-flex-bison-binaries | ||
| win-nasm | ||
| avtp.wrap | ||
| bindinator.wrap | ||
| cairo.wrap | ||
| dav1d.wrap | ||
| dssim.wrap | ||
| dv.wrap | ||
| expat.wrap | ||
| fdk-aac.wrap | ||
| FFmpeg.wrap | ||
| fontconfig.wrap | ||
| freetype2.wrap | ||
| fribidi.wrap | ||
| gl-headers.wrap | ||
| glib-networking.wrap | ||
| glib.wrap | ||
| graphene.wrap | ||
| gst-plugins-rs.wrap | ||
| gtk-sharp.wrap | ||
| harfbuzz.wrap | ||
| json-glib.wrap | ||
| lame.wrap | ||
| libdrm.wrap | ||
| libffi.wrap | ||
| libjpeg-turbo.wrap | ||
| libmicrodns.wrap | ||
| libnice.wrap | ||
| libopenjp2.wrap | ||
| libpng.wrap | ||
| libpsl.wrap | ||
| libsoup.wrap | ||
| libwpe.wrap | ||
| libxml2.wrap | ||
| ogg.wrap | ||
| openh264.wrap | ||
| opus.wrap | ||
| orc.wrap | ||
| pango.wrap | ||
| pixman.wrap | ||
| proxy-libintl.wrap | ||
| pycairo.wrap | ||
| pygobject.wrap | ||
| sqlite3.wrap | ||
| vorbis.wrap | ||
| webrtc-audio-processing.wrap | ||
| wpebackend-fdo.wrap | ||
| x264.wrap | ||
| zlib.wrap | ||