[Bug 701375] New: v4l2: rework sink buffer refcounting

[GStreamer (bugzilla.gnome.org)]

https://bugzilla.gnome.org/show_bug.cgi?id=701375
  GStreamer | gst-plugins-good | git

           Summary: v4l2: rework sink buffer refcounting
    Classification: Platform
           Product: GStreamer
           Version: git
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: m.olbrich at pengutronix.de
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---


Created an attachment (id=245757)
 --> (https://bugzilla.gnome.org/attachment.cgi?id=245757)
patch

This is a followup patch for #700781, which is not quite correct.
The buffer handling is quite complicated here.
The original code intended to the the following:

- gst_v4l2_buffer_pool_process() calls QBUF and adds the buffer to the
  local list.
- The sink calls gst_buffer_unref() which returns the buffer to the pool
  but not the 'free list'.
- Some time later DQBUF returns the buffer and
  gst_v4l2_buffer_pool_release_buffer() puts in on the 'free list'.

If the buffer must be copied then (parent_class)->acquire_buffer() is
called directly to keep the buffer in the pool.

This has two problems:
1. If gst_v4l2_buffer_pool_release_buffer() is called before the buffer is
   returned to the pool, then the buffer is put on the 'free list' twice.
   This can happen if a reference to the buffer is kept outside the sink,
   of if DQBUF returns the buffer, that was just queued with QBUF.
2. If buffers are copied, then all buffers are in the pool at all times. As
   a result gst_v4l2_buffer_pool_stop() and gst_v4l2_buffer_pool_dqbuf()
   can access pool->buffers at the same time, which can lead to memory
   corruption.

The patch for #700781 fixes those problems, but with the side effect that
there are always buffers outside the pool (because they are queued) and
the pool is never stopped.
This patch fixes this by releasing the reference to the buffer after
handling it (to avoid problem 2.) so it can be returned to the pool.
gst_v4l2_buffer_pool_release_buffer() is only called if the buffer is
already in the pool (to avoid problem 1.).

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.