[Bug 736041] Protect rtsp transport data.

Mon Sep 8 22:31:15 PDT 2014

https://bugzilla.gnome.org/show_bug.cgi?id=736041
  GStreamer | gst-rtsp-server | unspecified

Göran Jönsson <goran.jonsson> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #285454|0                           |1
        is obsolete|                            |

--- Comment #6 from Göran Jönsson <goran.jonsson at axis.com> 2014-09-09 05:31:09 UTC ---
Created an attachment (id=285710)
 View: https://bugzilla.gnome.org/attachment.cgi?id=285710
 Review: https://bugzilla.gnome.org/review?bug=736041&attachment=285710

gst-rtsp-server patch

New patch

- callback such as send_rtp, send_rtcp, keep_alive should be done outside of
the 
lock, if possible.

This is not possible, this is what happens for us.

Thread 4 (Thread 21491):
#0  do_send_data (buffer=0x5ac360, channel=0 '\000', client=0x0) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c:704
#1  0x77af2eb8 in handle_new_sample (sink=0x598250, user_data=<optimized out>)
at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-stream.c:1489
#2  0x77f46aa0 in gst_app_sink_render (psink=0x598250, buffer=0x5ac360) at
/home/goranjn/20140902/libs/gst-plugins-base/gst-plugins-base/gst-libs/gst/app/gstappsink.c:751
#3  0x77a8f4fc in gst_base_sink_chain_unlocked (basesink=0x598250,
obj=0x5ac360, is_list=0, pad=<optimized out>)
    at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c:3378
#4  0x77a9121c in gst_base_sink_chain_main (basesink=0x598250, pad=<optimized
out>, obj=0x5ac360, is_list=<optimized out>)
    at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c:3486
#5  0x779b4ec0 in gst_pad_chain_data_unchecked (data=0x5ac360, type=<optimized
out>, pad=0x58a038) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpad.c:3766
#6  gst_pad_push_data (pad=0x5a4190, type=<optimized out>, data=<optimized
out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpad.c:3996
#7  0x734af3d8 in gst_queue_push_one (queue=0x6381a8) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/plugins/elements/gstqueue.c:1120
#8  gst_queue_loop (pad=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/plugins/elements/gstqueue.c:1249
#9  0x779f1b40 in gst_task_func (task=0x5c0b48) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gsttask.c:316
#10 0x7783887c in g_thread_pool_thread_proxy (data=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthreadpool.c:309
#11 0x77837c48 in g_thread_proxy (data=0x5a1e90) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread.c:798
#12 0x77791578 in start_thread (arg=0x6d0894b0) at pthread_create.c:310
#13 0x774bccfc in __thread_start () from
target/mipsisa32r2el-axis-linux-gnu/lib/libc.so.6

Thread 11 (Thread 21417):
#0  __lll_lock_wait (futex=0x5c2f38, private=0) at
../nptl/sysdeps/unix/sysv/linux/lowlevellock.c:46
#1  0x77793d30 in __pthread_mutex_lock (mutex=0x5c2f38) at
pthread_mutex_lock.c:108
#2  0x7785c72c in g_mutex_lock (mutex=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread-posix.c:210
#3  0x77a88704 in gst_base_sink_change_state (element=0x598250,
transition=GST_STATE_CHANGE_PLAYING_TO_PAUSED)
    at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/libs/gst/base/gstbasesink.c:4941
#4  0x77999504 in gst_element_change_state (element=0x598250,
transition=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c:2602
#5  0x7799a10c in gst_element_set_state_func (element=0x598250,
state=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c:2558
#6  0x77974c10 in gst_bin_element_set_state (next=GST_STATE_PAUSED,
current=GST_STATE_PLAYING, start_time=4144013040, base_time=2360692186875,
element=0x598250, bin=0x5b2a00)
    at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstbin.c:2325
#7  gst_bin_change_state_func (element=0x5b2a00,
transition=GST_STATE_CHANGE_PLAYING_TO_PAUSED) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstbin.c:2648
#8  0x779c24b0 in gst_pipeline_change_state (element=0x5b2a00,
transition=GST_STATE_CHANGE_PLAYING_TO_PAUSED)
    at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstpipeline.c:471
#9  0x77999504 in gst_element_change_state (element=0x5b2a00,
transition=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c:2602
#10 0x7799a10c in gst_element_set_state_func (element=0x5b2a00,
state=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/gstreamer-special/1.2.4-patches/6/gstreamer/gst/gstelement.c:2558
#11 0x77aec7b0 in media_set_pipeline_state_locked (media=0x5b1588,
state=GST_STATE_PAUSED) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-media.c:2911
#12 0x77aed078 in gst_rtsp_media_set_state (media=0x5b1588,
state=GST_STATE_PAUSED, transports=0x75626120) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-media.c:3027
#13 0x77afd0cc in gst_rtsp_session_media_set_state (media=<optimized out>,
state=GST_STATE_PAUSED) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-session-media.c:453
#14 0x77b053c8 in handle_pause_request (ctx=0x700a6cb0, client=0x5d85d8) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c:1090
#15 handle_request (request=<optimized out>, client=0x5d85d8) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c:2216
#16 gst_rtsp_client_handle_message (client=0x5d85d8, message=<optimized out>)
at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-client.c:2781
#17 0x77f933d4 in gst_rtsp_source_dispatch_read (stream=<optimized out>,
watch=0x584800) at
/home/goranjn/20140902/libs/gst-plugins-base/gst-plugins-base/gst-libs/gst/rtsp/gstrtspconnection.c:3141
#18 0x778085b4 in g_main_dispatch (context=0x580070) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c:3061
#19 g_main_context_dispatch (context=0x580070) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c:3637
#20 0x77808a08 in g_main_context_iterate (context=0x580070, block=1,
dispatch=1, self=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c:3708
---Type <return> to continue, or q <return> to quit---
#21 0x778090b4 in g_main_loop_run (loop=0x59f830) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gmain.c:3902
#22 0x77ae2a14 in do_loop (thread=0x5b4d20) at
/home/goranjn/20140902/libs/gst-rtsp-server/gst-rtsp-server/gst/rtsp-server/rtsp-thread-pool.c:329
#23 0x7783887c in g_thread_pool_thread_proxy (data=<optimized out>) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthreadpool.c:309
#24 0x77837c48 in g_thread_proxy (data=0x5af860) at
/home/goranjn/20140902/unpacked/libs/glib-IR2.36.4-1/glib/glib/gthread.c:798
#25 0x77791578 in start_thread (arg=0x700a74b0) at pthread_create.c:310
#26 0x774bccfc in __thread_start () from
target/mipsisa32r2el-axis-linux-gnu/lib/libc.so.6
Backtrace stopped: frame did not save the PC

The do_send_data( send_rtp callback ) is crash because the client is NULL. And
if we look at thread 11 f #13 and f #14  we can see that 
unlink_session_transports (client, session, sessmedia) is called just before 
gst_rtsp_session_media_set_state.

The unlink_session_transports have been called the function unlink_transport (
this is tcp case ) that have called the
gst_rtsp_stream_transport_set_callbacks (trans, NULL, NULL, NULL, NULL);

So the mutex have to protect the callbacks and userdata.

-- 
Configure bugmail: https://bugzilla.gnome.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.
You are the assignee for the bug.