[Bug 737752] New: rtsp-client: crash when removing session

Wed Oct 1 14:42:09 PDT 2014

https://bugzilla.gnome.org/show_bug.cgi?id=737752
  GStreamer | gst-rtsp-server | git

           Summary: rtsp-client: crash when removing session
    Classification: Platform
           Product: GStreamer
           Version: git
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: gst-rtsp-server
        AssignedTo: gstreamer-bugs at lists.freedesktop.org
        ReportedBy: aconchillo at gmail.com
         QAContact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

If the client watch is being destroyed and client_watch_notify is called while
client_session_removed (via gst_rtsp_session_pool_cleanup) is also being called
we might end with a crash.

This is because client_watch_notify is called just after everything in the
watch has been freed (mutex, etc.) in gst_rtsp_source_finalize
(gstrtspconnection.c). If client_session_removed is executed just at that time
client->watch might still have a valid pointer but its internal data might be
invalid.

This is the error:

GLib (gthread-posix.c): Unexpected error from C library during
'pthread_mutex_lock': Invalid argument.  Aborting.

And this is the backtrace:

Thread 2 (Thread 0x7fcbd1be4700 (LWP 36208)):
#0  __lll_lock_wait () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:132
#1  0x00007fcbdb72a09b in _L_lock_1006 () from
/lib/x86_64-linux-gnu/libpthread.so.0
#2  0x00007fcbdb72a01c in __pthread_mutex_lock (mutex=0x7fcbcc027a50) at
pthread_mutex_lock.c:101
#3  0x00007fcbd89e49e7 in g_mutex_lock (mutex=<optimized out>) at
gthread-posix.c:216
#4  0x00007fcbd99c3d4d in gst_rtsp_client_session_filter
(client=0x7fca58f59750, func=0x7fcbd99bdd80 <cleanup_session>, user_data=0x0)
at rtsp-client.c:3426
#5  0x00007fcbd99c3f0c in client_watch_notify (client=0x7fca58f59750) at
rtsp-client.c:3337
#6  0x00007fcbd89a05b8 in g_source_unref_internal (source=0x7fcbcc04fc00,
context=0x7fcbcc022a30, have_lock=1) at gmain.c:1989
#7  0x00007fcbd89a3550 in g_main_dispatch (context=0x7fcbcc022a30) at
gmain.c:3091
#8  g_main_context_dispatch (context=0x7fcbcc022a30) at gmain.c:3663
#9  0x00007fcbd89a3738 in g_main_context_iterate (dispatch=1, block=<optimized
out>, context=0x7fcbcc022a30, self=<optimized out>) at gmain.c:3734
#10 g_main_context_iterate (context=0x7fcbcc022a30, block=<optimized out>,
dispatch=1, self=<optimized out>) at gmain.c:3671
#11 0x00007fcbd89a3a4a in g_main_loop_run (loop=0x7fcbcc022be0) at gmain.c:3928
#12 0x00007fcbd99a8938 in do_loop (thread=0x7fcbcc01c6c0) at
rtsp-thread-pool.c:329
#13 0x00007fcbd89c7d18 in g_thread_pool_thread_proxy (data=<optimized out>) at
gthreadpool.c:307
#14 0x00007fcbd89c74b5 in g_thread_proxy (data=0xb836d0) at gthread.c:764
#15 0x00007fcbdb727e9a in start_thread (arg=0x7fcbd1be4700) at
pthread_create.c:308
#16 0x00007fcbdb45531d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#17 0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7fcbd24e5700 (LWP 36192)):
#0  0x00007fcbdb3970d5 in __GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007fcbdb39a83b in __GI_abort () at abort.c:91
#2  0x00007fcbd8974655 in g_thread_abort (status=<optimized out>,
function=0x7fcbd8a6b72a "pthread_mutex_lock") at gthread-posix.c:80
#3  0x00007fcbd89e49f9 in g_mutex_lock (mutex=<optimized out>) at
gthread-posix.c:217
#4  0x00007fcbd978a3d9 in gst_rtsp_watch_set_send_backlog
(watch=0x7fcbcc04fc00, bytes=0, messages=0) at gstrtspconnection.c:3589
#5  0x00007fcbd99bdbd2 in client_session_removed (pool=<optimized out>,
session=0x7fca534a3460, client=0x7fca58f59750) at rtsp-client.c:2210
#6  0x00007fcbd4fe7a14 in ffi_call_unix64 () from
/usr/lib/x86_64-linux-gnu/libffi.so.6
#7  0x00007fcbd4fe7435 in ffi_call () from
/usr/lib/x86_64-linux-gnu/libffi.so.6
#8  0x00007fcbd8c9eddb in g_cclosure_marshal_generic (closure=0x7fcbc46b6bf0,
return_gvalue=0x0, n_param_values=2, param_values=<optimized out>,
invocation_hint=<optimized out>,
    marshal_data=0x7fcbd99bdb50) at gclosure.c:1448
#9  0x00007fcbd8c9e572 in g_closure_invoke (closure=0x7fcbc46b6bf0,
return_value=0x0, n_param_values=2, param_values=0x7fcbd24e4760,
invocation_hint=<optimized out>) at gclosure.c:768
#10 0x00007fcbd8cb0e01 in signal_emit_unlocked_R (node=<optimized out>,
detail=0, instance=<optimized out>, emission_return=0x0,
instance_and_params=0x7fcbd24e4760) at gsignal.c:3553
#11 0x00007fcbd8cb9141 in g_signal_emit_valist (instance=0x9de540,
signal_id=<optimized out>, detail=0, var_args=<optimized out>) at
gsignal.c:3309
#12 0x00007fcbd8cb93f2 in g_signal_emit (instance=<optimized out>,
signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3365
#13 0x00007fcbd99bd270 in gst_rtsp_session_pool_cleanup (pool=0x9de540) at
rtsp-session-pool.c:528
#14 0x00007fcbdbead4b5 in session_cleanup_timeout (vsrv=<optimized out>,
ignored=<optimized out>) at XXXXXXX.C:125
#15 0x00007fcbd89a3ecb in g_timeout_dispatch (source=0x7fcbcc01bf50,
callback=<optimized out>, user_data=<optimized out>) at gmain.c:4473
#16 0x00007fcbd89a33f9 in g_main_dispatch (context=0x7fcbcc001b10) at
gmain.c:3064
#17 g_main_context_dispatch (context=0x7fcbcc001b10) at gmain.c:3663
#18 0x00007fcbd89a3738 in g_main_context_iterate (dispatch=1, block=<optimized
out>, context=0x7fcbcc001b10, self=<optimized out>) at gmain.c:3734
#19 g_main_context_iterate (context=0x7fcbcc001b10, block=<optimized out>,
dispatch=1, self=<optimized out>) at gmain.c:3671
#20 0x00007fcbd89a3a4a in g_main_loop_run (loop=0x7fcbcc003cd0) at gmain.c:3928
#21 0x00007fcbdbeaeacd in thread_func (arg=0xa02490) at XXXXXXXXX.C:361
#22 0x00007fcbdb727e9a in start_thread (arg=0x7fcbd24e5700) at
pthread_create.c:308
#23 0x00007fcbdb45531d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#24 0x0000000000000000 in ?? ()

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.