[Bug 759292] New: Buffer free on error leads to infinite recursion in gstv4l2

Thu Dec 10 02:57:58 PST 2015

https://bugzilla.gnome.org/show_bug.cgi?id=759292

            Bug ID: 759292
           Summary: Buffer free on error leads to infinite recursion in
                    gstv4l2
    Classification: Platform
           Product: GStreamer
           Version: 1.6.1
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: jerome-bugzilla at jeromelaheurte.net
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

In our application, unplugging the USB camera while capture is in progress
sometimes leads to a SIGSEGV. After some looking aroud I came up with the
following dgb stack trace (not including everything obviously since it's more
than 10000 lines long):

#102751 0xf7f1d73f in gst_pad_chain_data_unchecked () from
../libs/libgstreamer-1.0.so
#102752 0xf7f1e261 in gst_pad_push_data () from ../libs/libgstreamer-1.0.so
#102753 0xf7f1e7d3 in gst_pad_push () from ../libs/libgstreamer-1.0.so
#102754 0xf76d0d16 in gst_base_src_loop () from ../libs/libgstbase-1.0.so
#102755 0xf7f53ee7 in gst_task_func () from ../libs/libgstreamer-1.0.so
#102756 0xf7f54fc8 in default_func () from ../libs/libgstreamer-1.0.so
#102757 0xf7ca4c36 in g_thread_pool_thread_proxy () from ../libs/libglib-2.0.so
#102758 0xf7ca46b0 in g_thread_proxy () from ../libs/libglib-2.0.so
#102759 0xf7a23f16 in start_thread (arg=0xed2efb40) at pthread_create.c:309
#102760 0xf780111e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:129
#102711 0xf7eda6c9 in default_release_buffer () from
../libs/libgstreamer-1.0.so
#102712 0xf54cab58 in gst_v4l2_buffer_pool_release_buffer () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102713 0xf7eda7ef in gst_buffer_pool_release_buffer () from
../libs/libgstreamer-1.0.so
#102714 0xf7ed4018 in _gst_buffer_dispose () from ../libs/libgstreamer-1.0.so
#102715 0xf7f120e7 in gst_mini_object_unref () from ../libs/libgstreamer-1.0.so
#102716 0xf54c70ad in gst_buffer_unref () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102717 0xf54c8c87 in gst_v4l2_buffer_pool_resurect_buffer () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102718 0xf7c0b766 in g_cclosure_marshal_VOID__VOIDv () from
../libs/libgobject-2.0.so
#102719 0xf7c09a91 in _g_closure_invoke_va () from ../libs/libgobject-2.0.so
#102720 0xf7c1c41b in g_signal_emit_valist () from ../libs/libgobject-2.0.so
#102721 0xf7c1ce1d in g_signal_emit () from ../libs/libgobject-2.0.so
#102722 0xf54b6162 in gst_v4l2_allocator_release () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102723 0xf54b56a4 in _v4l2mem_dispose () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102724 0xf7f120e7 in gst_mini_object_unref () from ../libs/libgstreamer-1.0.so
#102725 0xf7ed2dcd in gst_memory_unref () from ../libs/libgstreamer-1.0.so
#102726 0xf7ed4174 in _gst_buffer_free () from ../libs/libgstreamer-1.0.so
#102727 0xf7f121ea in gst_mini_object_unref () from ../libs/libgstreamer-1.0.so
#102728 0xf7ed7f46 in gst_buffer_unref () from ../libs/libgstreamer-1.0.so
#102729 0xf7ed8919 in default_free_buffer () from ../libs/libgstreamer-1.0.so
#102730 0xf7ed89cd in do_free_buffer () from ../libs/libgstreamer-1.0.so
#102731 0xf7eda6c9 in default_release_buffer () from
../libs/libgstreamer-1.0.so
#102732 0xf54cab58 in gst_v4l2_buffer_pool_release_buffer () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstvideo4linux2.so
#102733 0xf7eda7ef in gst_buffer_pool_release_buffer () from
../libs/libgstreamer-1.0.so
#102734 0xf7ed4018 in _gst_buffer_dispose () from ../libs/libgstreamer-1.0.so
#102735 0xf7f120e7 in gst_mini_object_unref () from ../libs/libgstreamer-1.0.so
#102736 0xf76d3e83 in gst_buffer_unref () from ../libs/libgstbase-1.0.so
#102737 0xf76da89a in gst_base_transform_chain () from
../libs/libgstbase-1.0.so
#102738 0xf7f1d73f in gst_pad_chain_data_unchecked () from
../libs/libgstreamer-1.0.so
#102739 0xf7f1e261 in gst_pad_push_data () from ../libs/libgstreamer-1.0.so
#102740 0xf7f1e7d3 in gst_pad_push () from ../libs/libgstreamer-1.0.so
#102741 0xf664acda in gst_tee_handle_data () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstcoreelements.so
#102742 0xf664b233 in gst_tee_chain () from
/home/jerome/dev/test-gstreamer-1.6.1/src/build/dist/quividi-test/VidiReports/../plugins/libgstcoreelements.so
#102743 0xf7f1d73f in gst_pad_chain_data_unchecked () from
../libs/libgstreamer-1.0.so
#102744 0xf7f1e261 in gst_pad_push_data () from ../libs/libgstreamer-1.0.so
#102745 0xf7f1e7d3 in gst_pad_push () from ../libs/libgstreamer-1.0.so
#102746 0xf7f03cc7 in gst_proxy_pad_chain_default () from
../libs/libgstreamer-1.0.so
#102747 0xf7f1d73f in gst_pad_chain_data_unchecked () from
../libs/libgstreamer-1.0.so
#102748 0xf7f1e261 in gst_pad_push_data () from ../libs/libgstreamer-1.0.so
#102749 0xf7f1e7d3 in gst_pad_push () from ../libs/libgstreamer-1.0.so
#102750 0xf76da82b in gst_base_transform_chain () from
../libs/libgstbase-1.0.so
#102751 0xf7f1d73f in gst_pad_chain_data_unchecked () from
../libs/libgstreamer-1.0.so
#102752 0xf7f1e261 in gst_pad_push_data () from ../libs/libgstreamer-1.0.so
#102753 0xf7f1e7d3 in gst_pad_push () from ../libs/libgstreamer-1.0.so
#102754 0xf76d0d16 in gst_base_src_loop () from ../libs/libgstbase-1.0.so
#102755 0xf7f53ee7 in gst_task_func () from ../libs/libgstreamer-1.0.so
#102756 0xf7f54fc8 in default_func () from ../libs/libgstreamer-1.0.so
#102757 0xf7ca4c36 in g_thread_pool_thread_proxy () from ../libs/libglib-2.0.so

When reproducing with GST_DEBUG=*:8 I get those traces (cropped as well):

0:00:18.890594759 18208 0x10c6ef80 ERROR          v4l2allocator
gstv4l2allocator.c:1245:gst_v4l2_allocator_qbuf:<v4l2src0:pool:src:allocator>
failed queing buffer 3: No such device
0:00:18.890657083 18208 0x10c6ef80 ERROR         v4l2bufferpool
gstv4l2bufferpool.c:1118:gst_v4l2_buffer_pool_qbuf:<v4l2src0:pool:src> could
not queue a buffer 3
0:00:18.890713099 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1218:default_release_buffer:<v4l2src0:pool:src> released buffer
0xe39fab40 16384
0:00:18.890773102 18208 0x10c6ef80 DEBUG        GST_PERFORMANCE
gstbufferpool.c:1242:default_release_buffer:<v4l2src0:pool:src> discarding
buffer 0xe39fab40: memory tag set
0:00:18.890832900 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:378:do_free_buffer:<v4l2src0:pool:src> freeing buffer
0xe39fab40 (3 left)
0:00:18.890886504 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe39fab40 unref 1->0
0:00:18.890945588 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:631:_gst_buffer_free: finalize 0xe39fab40
0:00:18.890998773 18208 0x10c6ef80 TRACE            GST_LOCKING
gstminiobject.c:248:gst_mini_object_unlock: unlock 0xe3901df8: state 00010000,
access_mode 4
0:00:18.891056956 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe3901df8 unref 1->0
0:00:18.891114069 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe3901df8 ref 0->1
0:00:18.891175897 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:351:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
plane 0 of buffer 3 released
0:00:18.891233601 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:367:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
buffer 3 released
0:00:18.891292172 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:673:gst_v4l2_buffer_pool_resurect_buffer:<v4l2src0:pool:src>
A buffer was lost, reallocating it
0:00:18.891367140 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:1291:gst_v4l2_buffer_pool_acquire_buffer:<v4l2src0:pool:src>
acquire
0:00:18.891422075 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1090:default_acquire_buffer:<v4l2src0:pool:src> no buffer,
trying to allocate
0:00:18.891474402 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstobject.c:254:gst_object_ref:<v4l2src0:pool:src:allocator> 0xe390c0a8 ref
10256->10257
0:00:18.891532954 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:705:gst_buffer_new: new 0xe39fabe0
0:00:18.891587054 18208 0x10c6ef80 TRACE            GST_LOCKING
gstminiobject.c:188:gst_mini_object_lock: lock 0xe3901df8: state 00000000,
access_mode 4
0:00:18.891643706 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe3901df8 ref 1->2
0:00:18.891700474 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe3901df8 unref 2->1
0:00:18.891757455 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:330:_memory_add: buffer 0xe39fabe0, idx -1, mem 0xe3901df8
0:00:18.891819899 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:282:do_alloc_buffer:<v4l2src0:pool:src> allocated buffer 3/32,
0xe39fabe0
0:00:18.891877664 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstobject.c:254:gst_object_ref:<v4l2src0:pool:src> 0xe390a060 ref 5128->5129
0:00:18.891936179 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe39fabe0 unref 1->0
0:00:18.891992321 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe39fabe0 ref 0->1
0:00:18.892048077 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:616:_gst_buffer_dispose: release 0xe39fabe0 to pool 0xe390a060
0:00:18.892107617 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:1369:gst_v4l2_buffer_pool_release_buffer:<v4l2src0:pool:src>
release buffer 0xe39fabe0
0:00:18.892166686 18208 0x10c6ef80 LOG           v4l2bufferpool
gstv4l2bufferpool.c:1074:gst_v4l2_buffer_pool_qbuf:<v4l2src0:pool:src> queuing
buffer 3
0:00:18.892240958 18208 0x10c6ef80 ERROR          v4l2allocator
gstv4l2allocator.c:1245:gst_v4l2_allocator_qbuf:<v4l2src0:pool:src:allocator>
failed queing buffer 3: No such device
0:00:18.892303660 18208 0x10c6ef80 ERROR         v4l2bufferpool
gstv4l2bufferpool.c:1118:gst_v4l2_buffer_pool_qbuf:<v4l2src0:pool:src> could
not queue a buffer 3
0:00:18.892361100 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1218:default_release_buffer:<v4l2src0:pool:src> released buffer
0xe39fabe0 16384
0:00:18.892419261 18208 0x10c6ef80 DEBUG        GST_PERFORMANCE
gstbufferpool.c:1242:default_release_buffer:<v4l2src0:pool:src> discarding
buffer 0xe39fabe0: memory tag set
0:00:18.892478805 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:378:do_free_buffer:<v4l2src0:pool:src> freeing buffer
0xe39fabe0 (3 left)
0:00:18.892532367 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe39fabe0 unref 1->0
0:00:18.892614761 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:631:_gst_buffer_free: finalize 0xe39fabe0
0:00:18.892683008 18208 0x10c6ef80 TRACE            GST_LOCKING
gstminiobject.c:248:gst_mini_object_unlock: unlock 0xe3901df8: state 00010000,
access_mode 4
0:00:18.892742733 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe3901df8 unref 1->0
0:00:18.892800493 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe3901df8 ref 0->1
0:00:18.892861484 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:351:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
plane 0 of buffer 3 released
0:00:18.892918910 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:367:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
buffer 3 released
0:00:18.892976684 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:673:gst_v4l2_buffer_pool_resurect_buffer:<v4l2src0:pool:src>
A buffer was lost, reallocating it
0:00:18.893033005 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:1291:gst_v4l2_buffer_pool_acquire_buffer:<v4l2src0:pool:src>
acquire
0:00:18.893085674 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1090:default_acquire_buffer:<v4l2src0:pool:src> no buffer,
trying to allocate
0:00:18.893139173 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstobject.c:254:gst_object_ref:<v4l2src0:pool:src:allocator> 0xe390c0a8 ref
10258->10259
0:00:18.893201432 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:705:gst_buffer_new: new 0xe39fac80
0:00:18.893254496 18208 0x10c6ef80 TRACE            GST_LOCKING
gstminiobject.c:188:gst_mini_object_lock: lock 0xe3901df8: state 00000000,
access_mode 4
0:00:18.893312122 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe3901df8 ref 1->2
0:00:18.893372001 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe3901df8 unref 2->1
0:00:18.893431508 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:330:_memory_add: buffer 0xe39fac80, idx -1, mem 0xe3901df8
0:00:18.893494508 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:282:do_alloc_buffer:<v4l2src0:pool:src> allocated buffer 3/32,
0xe39fac80
0:00:18.893551561 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstobject.c:254:gst_object_ref:<v4l2src0:pool:src> 0xe390a060 ref 5129->5130
0:00:18.893609185 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe39fac80 unref 1->0
0:00:18.893666734 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe39fac80 ref 0->1
0:00:18.893724944 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:616:_gst_buffer_dispose: release 0xe39fac80 to pool 0xe390a060
0:00:18.893786691 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:1369:gst_v4l2_buffer_pool_release_buffer:<v4l2src0:pool:src>
release buffer 0xe39fac80
0:00:18.893846510 18208 0x10c6ef80 LOG           v4l2bufferpool
gstv4l2bufferpool.c:1074:gst_v4l2_buffer_pool_qbuf:<v4l2src0:pool:src> queuing
buffer 3
0:00:18.893921372 18208 0x10c6ef80 ERROR          v4l2allocator
gstv4l2allocator.c:1245:gst_v4l2_allocator_qbuf:<v4l2src0:pool:src:allocator>
failed queing buffer 3: No such device
0:00:18.893997117 18208 0x10c6ef80 ERROR         v4l2bufferpool
gstv4l2bufferpool.c:1118:gst_v4l2_buffer_pool_qbuf:<v4l2src0:pool:src> could
not queue a buffer 3
0:00:18.894055078 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1218:default_release_buffer:<v4l2src0:pool:src> released buffer
0xe39fac80 16384
0:00:18.894114780 18208 0x10c6ef80 DEBUG        GST_PERFORMANCE
gstbufferpool.c:1242:default_release_buffer:<v4l2src0:pool:src> discarding
buffer 0xe39fac80: memory tag set
0:00:18.894176190 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:378:do_free_buffer:<v4l2src0:pool:src> freeing buffer
0xe39fac80 (3 left)
0:00:18.894232103 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe39fac80 unref 1->0
0:00:18.894290809 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:631:_gst_buffer_free: finalize 0xe39fac80
0:00:18.894343549 18208 0x10c6ef80 TRACE            GST_LOCKING
gstminiobject.c:248:gst_mini_object_unlock: unlock 0xe3901df8: state 00010000,
access_mode 4
0:00:18.894399810 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:440:gst_mini_object_unref: 0xe3901df8 unref 1->0
0:00:18.894458273 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstminiobject.c:360:gst_mini_object_ref: 0xe3901df8 ref 0->1
0:00:18.894532648 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:351:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
plane 0 of buffer 3 released
0:00:18.894586955 18208 0x10c6ef80 LOG            v4l2allocator
gstv4l2allocator.c:367:gst_v4l2_allocator_release:<v4l2src0:pool:src:allocator>
buffer 3 released
0:00:18.894631154 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:673:gst_v4l2_buffer_pool_resurect_buffer:<v4l2src0:pool:src>
A buffer was lost, reallocating it
0:00:18.894683331 18208 0x10c6ef80 DEBUG         v4l2bufferpool
gstv4l2bufferpool.c:1291:gst_v4l2_buffer_pool_acquire_buffer:<v4l2src0:pool:src>
acquire
0:00:18.894731410 18208 0x10c6ef80 LOG               bufferpool
gstbufferpool.c:1090:default_acquire_buffer:<v4l2src0:pool:src> no buffer,
trying to allocate
0:00:18.894782971 18208 0x10c6ef80 TRACE        GST_REFCOUNTING
gstobject.c:254:gst_object_ref:<v4l2src0:pool:src:allocator> 0xe390c0a8 ref
10260->10261
0:00:18.894832417 18208 0x10c6ef80 LOG               GST_BUFFER
gstbuffer.c:705:gst_buffer_new: new 0xe39fad20

Commenting out line 1129 in gstv4l2bufferpool.c (GST_BUFFER_FLAG_SET (buf,
GST_BUFFER_FLAG_TAG_MEMORY);) works around this in the sense that it prevents
the app from crashing. Probably introduces a memory leak though.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.