Video playback crashes with SIGSEGV in intel-media-driver: KernelDll_AllocateStates() from VphalRenderer::Initialize()

[Mark Dominik Bürkle]

* Impact
Totem segfaults when playing videos if gstreamer1.0-vaapi is installed on an Intel platform

* Test Case

- Download https://bugs.launchpad.net/ubuntu/+source/gstreamer-vaapi/+bug/1978153/+attachment/5596047/+files/Screencast%20from%2009-06-2022%2020%3A40%3A36.webm
- totem $video

it should play without crashing

also check if errors stop on
https://errors.ubuntu.com/problem/a09f9aa6132a1f12a9e44103be3ca0a859abfa2d

* Regression potential

The change is in the optimized intel rendering, if it was wrong the performances could be degraded or it could continue crashing

---

ProblemType: Crash
DistroRelease: Ubuntu 22.04
Package: libgstreamer1.0-0 1.20.0-1
ProcVersionSignature: Ubuntu 5.15.0-18.18-generic 5.15.12
Uname: Linux 5.15.0-18-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu78
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sun Feb 27 15:56:18 2022
ExecutablePath: /usr/bin/totem
InstallationDate: Installed on 2018-12-10 (1177 days ago)
InstallationMedia: Ubuntu 18.04.1 LTS "Bionic Beaver" - Release amd64 (20180725)
ProcCmdline: /usr/bin/totem --gapplication-service
SegvAnalysis:
 Segfault happened at: 0x7fd4c2239ccf: cmpl $0x10000,(%rbx)
 PC (0x7fd4c2239ccf) ok
 source "$0x10000" ok
 destination "(%rbx)" (0x7fd57824ec90) not located in a known VMA region (needed writable region)!
 Stack memory exhausted (SP below stack segment)
SegvReason: writing unknown VMA
Signal: 11
SourcePackage: gstreamer1.0
StacktraceTop:
 () at /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
 () at /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
 () at /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
 () at /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
 () at /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
Title: totem crashed with SIGSEGV
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dialout dip lpadmin plugdev sambashare sudo wireshark
separator:

[Apport retracing service (apport)]

StacktraceTop:
 KernelDll_AllocateStates (pKernelBin=<optimized out>, uKernelSize=0, pFcPatchCache=<optimized out>, uFcPatchCacheSize=<optimized out>, pDefaultRules=0x0, ModifyFunctionPointers=0x0) at ./media_driver/agnostic/common/vp/kdll/hal_kerneldll.c:2791
 VphalRenderer::Initialize (this=this@entry=0x7fd4bc1a26a0, pSettings=pSettings@entry=0x7fd4c3ffbd30, isApoEnabled=<optimized out>) at ./media_driver/agnostic/common/vp/hal/vphal_renderer.cpp:1417
 VphalState::Allocate (this=0x7fd4bc165a40, pVpHalSettings=0x7fd4c3ffbd30) at ./media_driver/agnostic/common/vp/hal/vphal.cpp:167
 DdiVp_InitVpHal (pVpCtx=0x7fd4bc15eb30) at ./media_driver/linux/common/vp/ddi/media_libva_vp.c:1811
 DdiVp_InitCtx (pVpCtx=<optimized out>, pVaDrvCtx=0x7fd4bc15eb30) at ./media_driver/linux/common/vp/ddi/media_libva_vp.c:1671

[Mark Dominik Bürkle (dominik-buerkle)]

might affect bugs:
1955758
1962495
1962623
1962624
1962626
1962630
1962633
I will add this text to all open bugs.

affected parts:
tracker-miner-fs-3
totem
gvfsd-mtp
udisksd

background information:
- installed 18.04 lts
- dist-upgraded to 20.04 lts
- back up before sending hardware for repair, got replacement hardware (with default rubbish)
- restore on replaced hardware with
-- modified filesystem (btrfs, dont remember previously used fs) and
-- full-disk encryption (multiple luks2 partitions instead of home-only)
- noticed that integrating grub-2.06 correctly (building package etc) would be too much effort
- downgraded luks-headers from luks2 to luks1 to make it compatible with grub used in 20.04
- added grub-setup script to include cryptmount grub module etc.
- got btrfs kernel warnings regularly
- dist-upgraded to 22.04 lts (beta, late January)
- still btrfs kernel warnings regularly
[- many updates since, as to be expected.]

[Daniel van Vugt (vanvugt)]

Tracking in https://errors.ubuntu.com/problem/a09f9aa6132a1f12a9e44103be3ca0a859abfa2d

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Daniel van Vugt (vanvugt)]

This is the top totem crash at the moment, by orders of magnitude.

[Daniel van Vugt (vanvugt)]

Tracking upstream in https://github.com/intel/media-driver/issues/1394

[Arnoud Rattink (arnoud-rattink)]

I found out 'totem /tmp/t.mp4' -> SEGV. This is intermittent. It sometimes says 'the specified movie could not be found' (about 25%) (but it does exist!)

However,

after 'su - guest' there are suddenly ZERO problems!

Also, this is a gstreamer/intel thing. In Qt5 'new QMediaPlayer(0);' also immediately crashes. So all Qt multimedia software is also affected by this bug.

[Sebastien Bacher (seb128)]

it's not an issue due to totem but to intel-media-driver

[Daniel van Vugt (vanvugt)]

Upstream fix proposed: https://github.com/intel/media-driver/pull/1423

[Sebastien Bacher (seb128)]

https://launchpad.net/ubuntu/+source/intel-media-driver/22.4.2+dfsg1-2

[Timo Aaltonen (tjaalton)]

Hello Mark, or anyone else affected,

Accepted intel-media-driver into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/intel-media-driver/22.3.1+dfsg1-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Daniel van Vugt (vanvugt)]

Verified fixed on jammy with intel-media-va-driver 22.3.1+dfsg1-1ubuntu1

You need to have gstreamer1.0-vaapi installed too.

Although now this crash is fixed I can reproduce bug 1978153.

[Launchpad Janitor (janitor)]

This bug was fixed in the package intel-media-driver - 22.3.1+dfsg1-1ubuntu1

---------------
intel-media-driver (22.3.1+dfsg1-1ubuntu1) jammy; urgency=medium

  * debian/patches/0003-Fix-driver-crash-with-no-kernel-binary.patch:
    - fix totem crashing when playing videos with vaapi installed
      (lp: #1962630)

 -- Sebastien Bacher <email address hidden> Fri, 10 Jun 2022 11:18:00 +0200

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for intel-media-driver has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Timo Aaltonen (tjaalton)]

why was this not fixed in intel-media-driver-non-free?