Bug#766058: mesa-vdpau-drivers: vlc crash with Radeon 3850HD

[Arthur Marsh <arthur.marsh@internode.on.net>]

Michel Dänzer wrote, on 21/10/14 12:57:

> > ==13424== Invalid read of size 1
> > ==13424==    at 0x1A8789C0: r600_bind_blend_state_internal (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A6723C0: blitter_restore_fragment_states (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A675C47: util_blitter_clear_render_target (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A852985: r600_clear_render_target (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A69D9A9: vl_compositor_render (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A629E96: vlVdpPresentationQueueDisplay (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1F2F80A3: Queue (in
> > /usr/lib/vlc/plugins/vdpau/libvdpau_display_plugin.so)
> > ==13424==    by 0x30D0E6DB48: ThreadDisplayPicture (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30022080A3: start_thread (pthread_create.c:309)
> > ==13424==  Address 0xedfe51d is 61 bytes inside a block of size 64 free'd
> > ==13424==    at 0x4A08E90: free (vg_replace_malloc.c:473)
> > ==13424==    by 0x1A62C7DD: vlVdpOutputSurfaceRenderBitmapSurface (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1F2F8200: Queue (in
> > /usr/lib/vlc/plugins/vdpau/libvdpau_display_plugin.so)
> > ==13424==    by 0x30D0E6DB48: ThreadDisplayPicture (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30022080A3: start_thread (pthread_create.c:309)
>
> This looks like a use-after-free bug in the Mesa r600g driver. Can you
> report this upstream at
> https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa , component
> Drivers/Gallium/r600?

Done:

https://bugs.freedesktop.org/show_bug.cgi?id=85267

> > ==13424== Invalid read of size 8
> > ==13424==    at 0x1A6A4291: destroy_video_buffer_private (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A6C0127: vl_video_buffer_destroy (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A627314: vlVdpVideoSurfaceDestroy (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x189B4092: SurfaceDestroy (in
> > /usr/lib/vlc/plugins/vdpau/libvdpau_avcodec_plugin.so)
> > ==13424==    by 0x30D0E8DCF4: picture_Release (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30D0E6D095: ThreadDisplayPreparePicture (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30D0E6D12B: ThreadDisplayPicture (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30D0E6DEB2: Thread (in /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x30022080A3: start_thread (pthread_create.c:309)
> > ==13424==  Address 0x6780940 is 480 bytes inside a block of size
> > 10,760 free'd
> > ==13424==    at 0x4A08E90: free (vg_replace_malloc.c:473)
> > ==13424==    by 0x1A6A44CA: vl_mpeg12_destroy (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x1A628489: vlVdpDecoderDestroy (in
> > /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_r600.so.1.0.0)
> > ==13424==    by 0x189B370D: Close (in
> > /usr/lib/vlc/plugins/vdpau/libvdpau_avcodec_plugin.so)
> > ==13424==    by 0x30D0E9028E: vlc_module_unload (in
> > /usr/lib/libvlccore.so.8.0.0)
> > ==13424==    by 0x1715EE48: vlc_va_Delete (in
> > /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
> > ==13424==    by 0x1715AA59: ffmpeg_GetFormat (in
> > /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
> > ==13424==    by 0x306F7FD5E0: ff_get_format (in
> > /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
> > ==13424==    by 0x306F6DDBC8: decode_chunks (in
> > /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
> > ==13424==    by 0x306F6DF8C8: mpeg_decode_frame (in
> > /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
> > ==13424==    by 0x306F7FBE1A: avcodec_decode_video2 (in
> > /usr/lib/x86_64-linux-gnu/libavcodec.so.56.1.0)
> > ==13424==    by 0x1715C18C: DecodeVideo (in
> > /usr/lib/vlc/plugins/codec/libavcodec_plugin.so)
>
> Looks like VLC destroys the VDPAU surface after the VDPAU decoder, and
> the Gallium VDPAU state tracker chokes on that. Can you report this
> upstream at https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa ,
> component "Mesa core"?

Done,

https://bugs.freedesktop.org/show_bug.cgi?id=85268

Regards,

Arthur.