[Bug 766025] New: rtpsession: race condition accessing ssrcs hash table

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=766025

            Bug ID: 766025
           Summary: rtpsession: race condition accessing ssrcs hash table
    Classification: Platform
           Product: GStreamer
           Version: 1.8.2
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: mparisdiaz at gmail.com
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

Hello,
I have noticed that there may be a race condition when managing SSRCs hash
table in the RtpSession object.

Specifically, I have found the problem iterating the hash table when the stats
are created for dumping the object params:
GLib-CRITICAL **: g_hash_table_foreach: assertion 'version ==
hash_table->version' failed

Analysing the GDB[1] output we can see that the problem is in function [2].

Refs
[1]
(gdb) bt
#0  0x00002b4f5f68b89b in g_logv (breakpoint=1) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmessages.c:324
#1  0x00002b4f5f68b89b in g_logv (log_domain=0x2b4f5f6cc5ce "GLib",
log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>,
args=args at entry=0x7ffe45672c90) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmessages.c:1081
#2  0x00002b4f5f68ba0f in g_log (log_domain=<optimized out>,
log_level=log_level at entry=G_LOG_LEVEL_CRITICAL,
format=format at entry=0x2b4f5f6d6114 "%s: assertion '%s' failed") at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmessages.c:1119
#3  0x00002b4f5f68ba49 in g_return_if_fail_warning (log_domain=<optimized out>,
pretty_function=<optimized out>, expression=<optimized out>) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./glib/gmessages.c:1128
#4  0x00002b4f658fe35f in rtp_session_get_property (sess=<optimized out>) at
rtpsession.c:736
#5  0x00002b4f658fe35f in rtp_session_get_property (object=<optimized out>,
prop_id=<optimized out>, value=0x7ffe45672e20, pspec=<optimized out>) at
rtpsession.c:899
#6  0x00002b4f5f3ffca2 in g_object_get_valist (value=0x7ffe45672e20,
pspec=0x1e28920 [GParamBoxed], object=0x1dda7b0 [RTPSession]) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gobject.c:1375
#7  0x00002b4f5f3ffca2 in g_object_get_valist (object=0x1dda7b0 [RTPSession],
first_property_name=<optimized out>, var_args=0x7ffe45672ed0) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gobject.c:2230
#8  0x00002b4f5f40013c in g_object_get (_object=0x1dda7b0,
first_property_name=first_property_name at entry=0x2b4f65913560 "stats") at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gobject.c:2320
#9  0x00002b4f6590a1f9 in gst_rtp_session_get_property (rtpsession=0x1e2c4e0
[GstRtpSession]) at gstrtpsession.c:1008
#10 0x00002b4f6590a1f9 in gst_rtp_session_get_property (object=0x1e2c4e0
[GstRtpSession], prop_id=<optimized out>, value=0x7ffe456730d0,
pspec=<optimized out>) at gstrtpsession.c:986
#11 0x00002b4f5f40067a in g_object_get_property (value=0x7ffe456730d0,
pspec=0x1e1ba20 [GParamBoxed], object=0x1e2c4e0 [GstRtpSession]) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gobject.c:1375
#12 0x00002b4f5f40067a in g_object_get_property (object=object at entry=0x1e2c4e0
[GstRtpSession], property_name=<optimized out>,
value=value at entry=0x7ffe456730d0) at
/build/glib2.0-ajuDY6/glib2.0-2.46.1/./gobject/gobject.c:2442
#13 0x00002b4f5f11361a in debug_dump_get_object_params
(object=object at entry=0x1e2c4e0 [GstRtpSession],
details=details at entry=GST_DEBUG_GRAPH_SHOW_ALL,
ignored_propnames=ignored_propnames at entry=0x0) at gstdebugutils.c:133

[2]
static GstStructure *
rtp_session_create_stats (RTPSession * sess)
{
  GstStructure *s;
  GValueArray *source_stats;
  GValue source_stats_v = G_VALUE_INIT;
  guint size;

  s = gst_structure_new ("application/x-rtp-session-stats",
      "rtx-drop-count", G_TYPE_UINT, sess->stats.nacks_dropped,
      "sent-nack-count", G_TYPE_UINT, sess->stats.nacks_sent,
      "recv-nack-count", G_TYPE_UINT, sess->stats.nacks_received, NULL);

  size = g_hash_table_size (sess->ssrcs[sess->mask_idx]);
  source_stats = g_value_array_new (size);
  g_hash_table_foreach (sess->ssrcs[sess->mask_idx],
      (GHFunc) create_source_stats, source_stats);

  g_value_init (&source_stats_v, G_TYPE_VALUE_ARRAY);
  g_value_take_boxed (&source_stats_v, source_stats);
  gst_structure_take_value (s, "source-stats", &source_stats_v);

  return s;
}

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.