[Bug]: Segfault when decoding H264 using mpv on Meteor Lake

[mattyoung101]

Which component impacted?

Decode

Is it regression? Good in old configuration?

None

What happened?

When playing an H264 video using mpv on a Meteor Lake CPU, there is a segfault in intel-media-driver. I wasn't sure if this is an upstream issue, but since the segfault occurred in this driver, I'm reporting it here.

OS: Arch Linux

mpv version: v0.39.0 with ffmpeg n7.0.2

intel-media-driver version: 24.3.3 from arch repos

gmmlib version: 22.5.2 from arch repos

What's the usage scenario when you are seeing the problem?

Playback

What impacted?

No response

Debug Information

Relevant log and full gdb backtrace:

[vo/gpu-next/vaapi] Failed to create mapper
[vo/gpu-next/vaapi] Unsupported format: uyvy422
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.
[ffmpeg] AVHWFramesContext: Created surface 0x1.
[ffmpeg] AVHWFramesContext: Direct mapping possible.
[ffmpeg] AVHWFramesContext: Map surface 0x1.
[ffmpeg] AVHWFramesContext: Unmap surface 0x1.

Thread 13 "vo" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffc7e006c0 (LWP 4006)]
__memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:660
660             rep     movsb
(gdb) bt
#0  __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:660
#1  0x00007fffb9a7cfa1 in memcpy (__dest=<optimized out>, __src=<optimized out>, __len=<optimized out>) at /usr/include/bits/string_fortified.h:29
#2  MosUtilities::MosSecureMemcpy (dstLength=<optimized out>, pDestination=<optimized out>, pSource=<optimized out>, srcLength=<optimized out>)
    at /usr/src/debug/intel-media-driver/media-driver-intel-media-24.3.3/media_softlet/linux/common/os/osservice/mos_utilities_specific.cpp:207
#3  MosUtilities::MosSecureMemcpy (pDestination=<optimized out>, dstLength=<optimized out>, pSource=<optimized out>, srcLength=<optimized out>)
    at /usr/src/debug/intel-media-driver/media-driver-intel-media-24.3.3/media_softlet/linux/common/os/osservice/mos_utilities_specific.cpp:194
#4  0x00007fffb9c3d4ac in MediaLibvaInterfaceNext::PutImage (ctx=0x7fff981e5520, surface=1, image=<optimized out>, srcX=0, srcY=0, srcWidth=2, srcHeight=2, destX=0, destY=0, destWidth=2,
    destHeight=2) at /usr/src/debug/intel-media-driver/media-driver-intel-media-24.3.3/media_softlet/linux/common/ddi/media_libva_interface_next.cpp:1827
#5  MediaLibvaInterface::PutImage (ctx=0x7fff981e5520, surface=1, image=<optimized out>, src_x=0, src_y=0, src_width=2, src_height=2, dest_x=0, dest_y=0, dest_width=2, dest_height=2)
    at /usr/src/debug/intel-media-driver/media-driver-intel-media-24.3.3/media_driver/linux/common/ddi/media_libva_interface.cpp:384
#6  0x00007ffff426b83f in vaPutImage (dpy=0x7fff982012e0, surface=surface@entry=1, image=0, src_x=src_x@entry=0, src_y=src_y@entry=0, src_width=2, src_height=2, dest_x=0, dest_y=0,
    dest_width=2, dest_height=2) at ../libva/va/va.c:1893
#7  0x00007ffff4e3c25d in vaapi_unmap_frame (hwfc=0x7fff983a9d40, hwmap=<optimized out>) at libavutil/hwcontext_vaapi.c:782
#8  0x00007ffff4e31743 in ff_hwframe_unmap (opaque=<optimized out>, data=0x7fff9836a180 "\200\2246\230\377\177") at libavutil/hwcontext.c:717
#9  0x00007ffff4e1c817 in buffer_replace (dst=<optimized out>, src=0x0) at libavutil/buffer.c:133
#10 av_buffer_unref (buf=<optimized out>) at libavutil/buffer.c:144
#11 av_buffer_unref (buf=<optimized out>) at libavutil/buffer.c:139
#12 0x00007ffff4e2b7cd in av_frame_unref (frame=0x7fff98368e40) at libavutil/frame.c:584
#13 av_frame_unref (frame=0x7fff98368e40) at libavutil/frame.c:576
#14 0x00007ffff4e2b92b in av_frame_free (frame=0x7fffc7df6cc0) at libavutil/frame.c:135
#15 0x00007ffff4e3dbce in vaapi_transfer_data_to (hwfc=<optimized out>, dst=0x7fff9835bb80, src=0x7fff9836a380) at libavutil/hwcontext_vaapi.c:993
#16 0x00007ffff4e318fa in av_hwframe_transfer_data (dst=0x7fff9835bb80, src=0x7fff9836a380, flags=flags@entry=0) at libavutil/hwcontext.c:481
#17 0x0000555555637d82 in mp_image_hw_upload (hw_img=0x7fff983676b0, src=0x7fff9863c200) at ../mpv/video/mp_image_pool.c:350
#18 mp_image_hw_upload (hw_img=0x7fff983676b0, src=0x7fff9863c200) at ../mpv/video/mp_image_pool.c:327
#19 mp_av_pool_image_hw_upload (hw_frames_ctx=<optimized out>, src=0x7fff9863c200) at ../mpv/video/mp_image_pool.c:438
#20 0x00005555556b8fff in try_format_upload (hw=hw@entry=0x7fff982259a0, pixfmt=<optimized out>) at ../mpv/video/out/hwdec/hwdec_vaapi.c:436
#21 0x00005555556b9a8c in try_format_config (hw=0x7fff982259a0, hwconfig=0x7fff981f9400) at ../mpv/video/out/hwdec/hwdec_vaapi.c:504
#22 determine_working_formats (hw=0x7fff982259a0) at ../mpv/video/out/hwdec/hwdec_vaapi.c:572
#23 init (hw=0x7fff982259a0) at ../mpv/video/out/hwdec/hwdec_vaapi.c:177
#24 0x0000555555631937 in ra_hwdec_load_driver (ra_ctx=<optimized out>, log=0x555555946b40, global=<optimized out>, devs=0x7fff980018e0, drv=0x5555557bfa80 <ra_hwdec_vaapi>, is_auto=true)
    at ../mpv/video/out/gpu/hwdec.c:104
#25 load_add_hwdec (ctx=0x5555559b49c0, devs=0x7fff980018e0, drv=0x5555557bfa80 <ra_hwdec_vaapi>, is_auto=true) at ../mpv/video/out/gpu/hwdec.c:236
#26 load_add_hwdec (ctx=0x5555559b49c0, devs=0x7fff980018e0, drv=0x5555557bfa80 <ra_hwdec_vaapi>, is_auto=<optimized out>) at ../mpv/video/out/gpu/hwdec.c:226
#27 0x0000555555639a22 in ra_hwdec_ctx_load_fmt (ctx=0x5555559b49c0, devs=0x7fff980018e0, params=0x7fffffffd6a0) at ../mpv/video/out/gpu/hwdec.c:332
#28 0x000055555566c901 in control (vo=0x555555902f40, request=<optimized out>, data=0x7fffffffd6a0) at ../mpv/video/out/vo_gpu_next.c:1558
#29 0x0000555555649d9e in run_control (p=0x7fffffffd5f0) at ../mpv/video/out/vo.c:652
#30 0x00005555555c4cc2 in mp_dispatch_queue_process (queue=0x555555902db0, timeout=<optimized out>) at ../mpv/misc/dispatch.c:300
#31 0x00005555556531ce in vo_thread (ptr=<optimized out>) at ../mpv/video/out/vo.c:1100
#32 0x00007ffff40bd39d in start_thread (arg=<optimized out>) at pthread_create.c:447
#33 0x00007ffff414249c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Display info:

$ lspci -nn |grep  -Ei 'VGA|DISPLAY'
00:02.0 VGA compatible controller [0300]: Intel Corporation Meteor Lake-P [Intel Arc Graphics] [8086:7d55] (rev 08)

Do you want to contribute a patch to fix the issue?

None

[mattyoung101]

libva trace:

libva_trace.log.062157.thd-0x00001516.txt

[Jexu]

Looks that is same issue in #1800.

@pengwan1 Could port the fix in 722793d to APO ddi as well.

[mattyoung101]

Sorry, just to clarify, I built the driver again from source using the latest commit from master, but the segfault still occurs. Is the fix in 722793d applied to the current master? vainfo reports iHD version 24.4.0 (ce9892cb8).

[mattyoung101]

Also I'm happy to port the fix in that commit if you'd like, but I'm not sure what file the APO DDI is in. Are you talking about media_softlet/linux/common/ddi/media_libva_interface_next.cpp line 1827?