Bug#766058: mesa-vdpau-drivers: vlc crash with Radeon 3850HD
On 20.10.2014 22:44, Arthur Marsh wrote:
==13424== Invalid write of size 1
==13424== at 0x315BA045B7: BOSA_ST_InitComponentLoader (in /usr/lib/libomxil-bellagio.so.0.0.0)
==13424== by 0x315BA055A7: OMX_Init (in /usr/lib/libomxil-bellagio.so.0.0.0)
==13424== by 0x16D4BADB: InitOmxCore (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x16D4A99C: OpenGeneric (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x16D4B6DF: OpenDecoder (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x30D0E8F7E4: module_load (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E8FD9D: vlc_module_load (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E3F865: CreateDecoder (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E42464: input_DecoderNew (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E45595: EsCreateDecoder (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E4641A: EsSelect (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E469E2: EsOutSelect (in /usr/lib/libvlccore.so.8.0.0)
==13424== Address 0x54331e0 is 0 bytes after a block of size 2,048 alloc'd
==13424== at 0x4A07C20: malloc (vg_replace_malloc.c:296)
==13424== by 0x315BA0452E: BOSA_ST_InitComponentLoader (in /usr/lib/libomxil-bellagio.so.0.0.0)
==13424== by 0x315BA055A7: OMX_Init (in /usr/lib/libomxil-bellagio.so.0.0.0)
==13424== by 0x16D4BADB: InitOmxCore (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x16D4A99C: OpenGeneric (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x16D4B6DF: OpenDecoder (in /usr/lib/vlc/plugins/codec/libomxil_plugin.so)
==13424== by 0x30D0E8F7E4: module_load (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E8FD9D: vlc_module_load (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E3F865: CreateDecoder (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E42464: input_DecoderNew (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E45595: EsCreateDecoder (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E4641A: EsSelect (in /usr/lib/libvlccore.so.8.0.0)
This looks like a buffer overflow bug in
/usr/lib/libomxil-bellagio.so.0.0.0.
==13424== Invalid read of size 1
==13424== at 0x1A8789C0: r600_bind_blend_state_internal (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A6723C0: blitter_restore_fragment_states (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A675C47: util_blitter_clear_render_target (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A852985: r600_clear_render_target (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A69D9A9: vl_compositor_render (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A629E96: vlVdpPresentationQueueDisplay (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1F2F80A3: Queue (in /usr/lib/vlc/plugins/vdpau/libvdpau_display_plugin.so)
==13424== by 0x30D0E6DB48: ThreadDisplayPicture (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30022080A3: start_thread (pthread_create.c:309)
==13424== Address 0xedfe51d is 61 bytes inside a block of size 64 free'd
==13424== at 0x4A08E90: free (vg_replace_malloc.c:473)
==13424== by 0x1A62C7DD: vlVdpOutputSurfaceRenderBitmapSurface (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1F2F8200: Queue (in /usr/lib/vlc/plugins/vdpau/libvdpau_display_plugin.so)
==13424== by 0x30D0E6DB48: ThreadDisplayPicture (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30022080A3: start_thread (pthread_create.c:309)
This looks like a use-after-free bug in the Mesa r600g driver. Can you
report this upstream at
https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa , component
Drivers/Gallium/r600?
==13424== Invalid read of size 8
==13424== at 0x1A6A4291: destroy_video_buffer_private (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A6C0127: vl_video_buffer_destroy (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A627314: vlVdpVideoSurfaceDestroy (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x189B4092: SurfaceDestroy (in /usr/lib/vlc/plugins/vdpau/libvdpau_avcodec_plugin.so)
==13424== by 0x30D0E8DCF4: picture_Release (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E6D095: ThreadDisplayPreparePicture (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E6D12B: ThreadDisplayPicture (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x30022080A3: start_thread (pthread_create.c:309)
==13424== Address 0x6780940 is 480 bytes inside a block of size 10,760 free'd
==13424== at 0x4A08E90: free (vg_replace_malloc.c:473)
==13424== by 0x1A6A44CA: vl_mpeg12_destroy (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x1A628489: vlVdpDecoderDestroy (in /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
==13424== by 0x189B370D: Close (in /usr/lib/vlc/plugins/vdpau/libvdpau_avcodec_plugin.so)
==13424== by 0x30D0E9028E: vlc_module_unload (in /usr/lib/libvlccore.so.8.0.0)
==13424== by 0x1715EE48: vlc_va_Delete (in /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
==13424== by 0x1715AA59: ffmpeg_GetFormat (in /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
==13424== by 0x306F7FD5E0: ff_get_format (in /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
==13424== by 0x306F6DDBC8: decode_chunks (in /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
==13424== by 0x306F6DF8C8: mpeg_decode_frame (in /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
==13424== by 0x306F7FBE1A: avcodec_decode_video2 (in /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
==13424== by 0x1715C18C: DecodeVideo (in /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
Looks like VLC destroys the VDPAU surface after the VDPAU decoder, and
the Gallium VDPAU state tracker chokes on that. Can you report this
upstream at https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa ,
component "Mesa core"?
--
Earthling Michel Dänzer | http://www.amd.com
Libre software enthusiast | Mesa and X developer
Reply to: