From patchwork Tue Mar 9 14:35:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marian Cichy X-Patchwork-Id: 11539 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 4EFFEBD1F1 for ; Tue, 9 Mar 2021 14:35:23 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id D9EC468AA3; Tue, 9 Mar 2021 15:35:22 +0100 (CET) Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 60E2568A99 for ; Tue, 9 Mar 2021 15:35:21 +0100 (CET) Received: from dude02.hi.pengutronix.de ([2001:67c:670:100:1d::28]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lJdSC-0000zZ-PX; Tue, 09 Mar 2021 15:35:20 +0100 Received: from mci by dude02.hi.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1lJdSC-0008JN-HD; Tue, 09 Mar 2021 15:35:20 +0100 From: Marian Cichy To: libcamera-devel@lists.libcamera.org Date: Tue, 9 Mar 2021 15:35:18 +0100 Message-Id: <20210309143518.31405-1-m.cichy@pengutronix.de> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::28 X-SA-Exim-Mail-From: mci@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: libcamera-devel@lists.libcamera.org Subject: [libcamera-devel] [PATCH] libcamera: gst: Fix double-free when acquire_buffer fails X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: graphics@pengutronix.de, Marian Cichy Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" If gst_buffer_pool_acquire_buffer in gst_libcamera_task_run fails, the unique_ptr to the request-object gets reset and hence, its destructor is called. However, the wrap-object points to the same object and is still alive at this moment. When the task_run-function is finished, the destructor of the wrap-object is called, which in return calls the destructor of the request-object again. Also note the wrong comment, which claims that WrapRequest does not take ownership of the request, however, actually it already has ownership. Replacing request.reset() with request.release() doesn't call the destructor on the request-object and only one free happens at the end. Signed-off-by: Marian Cichy --- src/gstreamer/gstlibcamerasrc.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/gstreamer/gstlibcamerasrc.cpp b/src/gstreamer/gstlibcamerasrc.cpp index a8ed7652..b0194c2f 100644 --- a/src/gstreamer/gstlibcamerasrc.cpp +++ b/src/gstreamer/gstlibcamerasrc.cpp @@ -279,10 +279,12 @@ gst_libcamera_src_task_run(gpointer user_data) &buffer, nullptr); if (ret != GST_FLOW_OK) { /* - * RequestWrap does not take ownership, and we won't be + * RequestWrap has ownership, and we won't be * queueing this one due to lack of buffers. + * So the request will be freed when RequestWrap + * goes out of scope. */ - request.reset(); + request.release(); break; }