From 46a41667a3abc6d1105b9c954f6f6694707ef379 Mon Sep 17 00:00:00 2001 From: Philipp Zabel Date: Fri, 5 Apr 2024 17:30:01 +0200 Subject: [PATCH] v4l2bufferpool: Ensure freshly created buffers are not marked as queued Otherwise, if we run in to the copy case, this can cause these groups to stay around with queued flag set, but never actually queued, until gst_v4l2_allocator_flush() is called, which then erroneously frees the associated memories, causing the release function to decrement the allocator refcount where it was never incremented, resulting in early allocator disposal, and either deadlock or use after free. Part-of: --- subprojects/gst-plugins-good/sys/v4l2/gstv4l2allocator.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/subprojects/gst-plugins-good/sys/v4l2/gstv4l2allocator.c b/subprojects/gst-plugins-good/sys/v4l2/gstv4l2allocator.c index 9900a25a11..aa54b9a0d7 100644 --- a/subprojects/gst-plugins-good/sys/v4l2/gstv4l2allocator.c +++ b/subprojects/gst-plugins-good/sys/v4l2/gstv4l2allocator.c @@ -272,6 +272,13 @@ gst_v4l2_memory_group_new (GstV4l2Allocator * allocator, guint32 index) return NULL; } + if (IS_QUEUED (group->buffer)) { + GST_WARNING_OBJECT (allocator, + "Driver pretends buffer %d is queued even if freshly created, " + "this indicates a bug in the driver.", group->buffer.index); + UNSET_QUEUED (group->buffer); + } + /* Check that provided size matches the format we have negotiation. Failing * there usually means a driver of libv4l bug. */ if (V4L2_TYPE_IS_MULTIPLANAR (obj->type)) {