[Bug 1202828] New: libva driver_data in vdpau_common_Initialize can have a null pointer for x11_dpy which is not checked
https://bugzilla.suse.com/show_bug.cgi?id=1202828 Bug ID: 1202828 Summary: libva driver_data in vdpau_common_Initialize can have a null pointer for x11_dpy which is not checked Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs@suse.de Reporter: mrueckert@suse.com QA Contact: gfx-bugs@suse.de Found By: --- Blocker: --- This caused a crash via firefox ``` (gdb) bt #0 XDisplayString (dpy=0x0) at /usr/src/debug/libX11-1.8.1-2.1.x86_64/src/Macros.c:119 #1 0x00007fdbae377b85 in vdpau_common_Initialize (driver_data=0x7fdbb18b6800) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver.c:188 #2 vdpau_Initialize_Current (ctx=0x7fdbb0fed3e0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver_template.h:561 #3 __vaDriverInit_1_14 (ctx=0x7fdbb0fed3e0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.9.x86_64/src/vdpau_driver.c:317 #4 0x00007fdbae334fcf in va_openDriver (dpy=dpy@entry=0x7fdbbcb30480, driver_name=<optimized out>) at /usr/src/debug/libva-2.15.0-1.1.x86_64/va/va.c:525 #5 0x00007fdbae33ae0e in vaInitialize (dpy=0x7fdbbcb30480, major_version=0x7ffec62bdbfc, minor_version=0x7ffec62bdc00) at /usr/src/debug/libva-2.15.0-1.1.x86_64/va/va.c:743 #6 0x00007fdbb5b0d002 in vaInitialize () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/media/mozva/mozva.c:411 #7 vaInitialize () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/media/mozva/mozva.c:408 #8 childvaapitest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1012 #9 vaapitest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1071 #10 childgltest () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1164 #11 0x00007fdbb5b60dde in fire_glxtest_process () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/glxtest.cpp:1200 #12 XREMain::XRE_mainInit () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:4017 #13 XREMain::XRE_mainInit () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:3903 #14 XREMain::XRE_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:5916 #15 XRE_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/toolkit/xre/nsAppRunner.cpp:6010 #16 0x000056092672e3fd in do_main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/browser/app/nsBrowserApp.cpp:227 #17 0x0000560926726c20 in main () at /usr/src/debug/MozillaFirefox-103.0.2-2.1.x86_64/browser/app/nsBrowserApp.cpp:406 ``` though another interesting question is ... why was that a null pointer in first place. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1202828 https://bugzilla.suse.com/show_bug.cgi?id=1202828#c1 --- Comment #1 from Marcus R�ckert <mrueckert@suse.com> --- This is reproducible ... just go to https://meet.opensuse.org/somechannel -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1202828 https://bugzilla.suse.com/show_bug.cgi?id=1202828#c2 Stefan Dirsch <sndirsch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS CC| |mrueckert@suse.com Flags| |needinfo?(mrueckert@suse.co | |m) --- Comment #2 from Stefan Dirsch <sndirsch@suse.com> --- I'm wondering why are you using the VDPAU-based backend for VA-API "libva-vdpau-driver". Which graphics are you using? NVIDIA and their proprietary driver? firefox doesn't support VDPAU? vainfo (libva-utils package) crahes as well? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1202828 https://bugzilla.suse.com/show_bug.cgi?id=1202828#c3 Marcus R�ckert <mrueckert@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mrueckert@suse.co | |m) | --- Comment #3 from Marcus R�ckert <mrueckert@suse.com> --- ``` vainfo libva info: VA-API version 1.15.0 libva info: User environment variable requested driver 'vdpau' libva info: Trying to open /usr/lib64/dri/vdpau_drv_video.so libva info: Found init function __vaDriverInit_1_14 libva info: va_openDriver() returns 0 vainfo: VA-API version: 1.15 (libva 2.15.0) vainfo: Driver version: Splitted-Desktop Systems VDPAU backend for VA-API - 0.7.4 vainfo: Supported profile and entrypoints VAProfileMPEG2Simple : VAEntrypointVLD VAProfileMPEG2Main : VAEntrypointVLD VAProfileMPEG4Simple : VAEntrypointVLD VAProfileMPEG4AdvancedSimple : VAEntrypointVLD <unknown profile> : VAEntrypointVLD VAProfileH264Main : VAEntrypointVLD VAProfileH264High : VAEntrypointVLD VAProfileVC1Simple : VAEntrypointVLD VAProfileVC1Main : VAEntrypointVLD VAProfileVC1Advanced : VAEntrypointVLD ``` 515.65.01 for a NVIDIA Corporation TU104 [GeForce RTX 2070 SUPER] (rev a1) I just found the crash because i wanted to check another crash with coredumpctl and then saw that FF crashed. then retried jitsi and saw that it is reproducible. one interesting thing i noticed in the stack trace: all the way up to va_openDriver the dpy structure has a correct value. and the CTX() macro/function does something weird and then the x11_dpy pointer is NULL. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1202828 https://bugzilla.suse.com/show_bug.cgi?id=1202828#c4 Stefan Dirsch <sndirsch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #4 from Stefan Dirsch <sndirsch@suse.com> --- Ok. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1202828 https://bugzilla.suse.com/show_bug.cgi?id=1202828#c7 --- Comment #7 from Marcus R�ckert <mrueckert@suse.com> --- ``` (gdb) bt #0 XDisplayString (dpy=0x0) at /usr/src/debug/libX11-1.8.2/src/Macros.c:119 #1 0x00007fb6ddaf7b85 in vdpau_common_Initialize (driver_data=0x7fb6dd772800) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.10.x86_64/src/vdpau_driver.c:188 #2 vdpau_Initialize_Current (ctx=0x7fb6ec3225c0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.10.x86_64/src/vdpau_driver_template.h:561 #3 __vaDriverInit_1_15 (ctx=0x7fb6ec3225c0) at /usr/src/debug/libva-vdpau-driver-0.7.4-7.10.x86_64/src/vdpau_driver.c:317 #4 0x00007fb6ddab3051 in va_openDriver (dpy=dpy@entry=0x7fb6ec3651a0, driver_name=<optimized out>) at /usr/src/debug/libva-2.16.0/va/va.c:525 #5 0x00007fb6ddab808e in vaInitialize (dpy=0x7fb6ec3651a0, major_version=0x7fffbb76ad2c, minor_version=0x7fffbb76ad30) at /usr/src/debug/libva-2.16.0/va/va.c:743 #6 0x00007fb6e5251f27 in vaInitialize () at /usr/src/debug/firefox-107.0/media/mozva/mozva.c:411 #7 vaInitialize () at /usr/src/debug/firefox-107.0/media/mozva/mozva.c:408 #8 childvaapitest () at /usr/src/debug/firefox-107.0/toolkit/xre/glxtest.cpp:1038 #9 vaapitest () at /usr/src/debug/firefox-107.0/toolkit/xre/glxtest.cpp:1102 #10 childgltest () at /usr/src/debug/firefox-107.0/toolkit/xre/glxtest.cpp:1195 #11 0x00007fb6e52944af in fire_glxtest_process () at /usr/src/debug/firefox-107.0/toolkit/xre/glxtest.cpp:1236 #12 XREMain::XRE_mainInit () at /usr/src/debug/firefox-107.0/toolkit/xre/nsAppRunner.cpp:4012 #13 XREMain::XRE_mainInit () at /usr/src/debug/firefox-107.0/toolkit/xre/nsAppRunner.cpp:3898 #14 XREMain::XRE_main () at /usr/src/debug/firefox-107.0/toolkit/xre/nsAppRunner.cpp:5890 #15 XRE_main () at /usr/src/debug/firefox-107.0/toolkit/xre/nsAppRunner.cpp:5972 #16 0x000056034ce682fd in do_main () at /usr/src/debug/firefox-107.0/browser/app/nsBrowserApp.cpp:226 #17 0x000056034ce60a2c in main () at /usr/src/debug/firefox-107.0/browser/app/nsBrowserApp.cpp:428 ``` -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com