From patchwork Mon Jul 22 09:43:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anton Khirnov X-Patchwork-Id: 50677 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a59:a742:0:b0:482:c625:d099 with SMTP id f2csp1902716vqm; Mon, 22 Jul 2024 02:44:13 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXUDed44eS+QvYs8KngSpMZvvPtdBBbUjhiFHlh7pAlKGgrk9Xc26e4+5hM3TJ05Vqw0pmfPaXtsd/9s81v66SqZzxTwuafNrMglg== X-Google-Smtp-Source: AGHT+IFEd+mcoaORWPuQtjWkpfmE7YP71FWj+wLu9edoFlVOqIvSLWPN96Q9P9To0rABXw1lcMlo X-Received: by 2002:a5d:47a7:0:b0:368:4def:921a with SMTP id ffacd0b85a97d-369bb2b3d24mr6126104f8f.48.1721641453200; Mon, 22 Jul 2024 02:44:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1721641453; cv=none; d=google.com; s=arc-20160816; b=HBmW2VaD5nY9eaKT+FRO1Ks+otL09VAUnl4hYk+9XUTeKApatXsT/FhuQDta/uA6PL oN4HzrQanKIkOcORtLuTDVbzMgkNnSQw2qtVqjRlqrgw6TquYvjXyEaE3P1VjyH6gz7I fLzW6cIHhpKV9ICSCeIoChg8iS9JmdNDVHXwmhP3x/iGMtXS8ZXeZlkNouVF5ZOuhJgK SahfnXU+LSMMujujAn7vEjwhilNN7PLdI3uBBw2j5dC259suX37ovGH99Xo3V8SE8+PD Fj42vTo8gO0xxP51SCZ+egHrMR3xZ3MKjhNwe50MJMtGn5rjxu0DGC0h9PmrFfRPjeXW BZQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:references:in-reply-to:message-id :date:to:from:dkim-signature:delivered-to; bh=UEqMYUhB7dAcOK9kaAyq1ENlcV4WaYKxyyCw/2sOi1s=; fh=YOA8vD9MJZuwZ71F/05pj6KdCjf6jQRmzLS+CATXUQk=; b=qVAZsau5TGHn+kjaY2SRk9s59jgBpZVm5tVU76sCuu4Mr1Jo77pEA/Oeo8i9PPdgIh jvN8pqCrGzYMuTPIj2r1TBWo6y2HE0B+lE3TwyhIiM7oR617pWjb+FVClGdTBU36Mdho 2PtCu3dtJ0GEnsSKFods8GrGUz/ACqCDJTal9NO0gRCJIRb28rvJuTxPhtsHsJ8731b9 s0mKye3hi3ORrEX7up9M7t4pbOAXw2PSAryT8Q6PK2txZt0r8mWdi/shJqrKtBQtms2K lV6DoHDoBeGo5ip/GadA+vbqtV0W37GUF8TWQpW6//0znWOyNSRS2E51xuQUFsspDBMa Lg4w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@khirnov.net header.s=mail header.b=OokbjicT; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id a640c23a62f3a-a7a3c95100fsi358712166b.748.2024.07.22.02.44.12; Mon, 22 Jul 2024 02:44:13 -0700 (PDT) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@khirnov.net header.s=mail header.b=OokbjicT; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9822D68D6FA; Mon, 22 Jul 2024 12:43:53 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail1.khirnov.net (quelana.khirnov.net [94.230.150.81]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E755168D645 for ; Mon, 22 Jul 2024 12:43:42 +0300 (EEST) Authentication-Results: mail1.khirnov.net; dkim=pass (2048-bit key; unprotected) header.d=khirnov.net header.i=@khirnov.net header.a=rsa-sha256 header.s=mail header.b=OokbjicT; dkim-atps=neutral Received: from localhost (mail1.khirnov.net [IPv6:::1]) by mail1.khirnov.net (Postfix) with ESMTP id 0553625F for ; Mon, 22 Jul 2024 11:43:40 +0200 (CEST) Received: from mail1.khirnov.net ([IPv6:::1]) by localhost (mail1.khirnov.net [IPv6:::1]) (amavis, port 10024) with ESMTP id jjmyoVjnBSUz for ; Mon, 22 Jul 2024 11:43:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=khirnov.net; s=mail; t=1721641418; bh=NvySu4ojiYbj4Ubq1kttwMakuc7dAP6jT6hbtoWZaCg=; h=From:To:Subject:Date:In-Reply-To:References:From; b=OokbjicTqw0hEN01MPB/Lz/YFvKTLSR1VJIK/NwF1Tz5QutYSQdYQotThJABdLjLn OnjCbwiOjr4h2MAfmFYxMDAN/4UlCy51JdLLHgirklJENaGzqJ3i9Th2E1baQgGUjC 3tRnfPyrZSSZpV7594o+uwGBGA38+WxBjtW5TZDYm92ZrdzxzaAi+1t8ESfaJdUVao WYRTnT6Qhl2LbwtfggZvGwdzIRRP2KGd92pYC/OhAXOFPoxzGhWcY3rJzGSbgUWdvn vASSHd9t9Y/g7MPlSf7eoMrUJoo+C7e9e/Skm7Luspz6/r0ooUgV0fwvbZFe2FU8UE EsTPPaWCKnluQ== Received: from libav.khirnov.net (libav.khirnov.net [IPv6:2a00:c500:561:201::7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "libav.khirnov.net", Issuer "smtp.khirnov.net SMTP CA" (verified OK)) by mail1.khirnov.net (Postfix) with ESMTPS id 7662D4DDE for ; Mon, 22 Jul 2024 11:43:37 +0200 (CEST) Received: from libav.khirnov.net (libav.khirnov.net [IPv6:::1]) by libav.khirnov.net (Postfix) with ESMTP id 499CA3A083A for ; Mon, 22 Jul 2024 11:43:31 +0200 (CEST) From: Anton Khirnov To: ffmpeg-devel@ffmpeg.org Date: Mon, 22 Jul 2024 11:43:22 +0200 Message-ID: <20240722094322.28916-3-anton@khirnov.net> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240722094322.28916-1-anton@khirnov.net> References: <20240717205156.GT4991@pb2> <20240722094322.28916-1-anton@khirnov.net> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 3/3] lavc/ffv1dec: fix races in accessing FFV1SliceContext.slice_damaged X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 21KQuhQHuL01 That variable is shared between frame threads in the same defective way described in the previous commit. Fix it by adding a RefStruct-managed arrays of flags that is propagated across frame threads in the standard manner. Remove now-unused FFV1Context.fsrc --- libavcodec/ffv1.c | 2 ++ libavcodec/ffv1.h | 9 ++++++++- libavcodec/ffv1dec.c | 26 +++++++++++++------------- 3 files changed, 23 insertions(+), 14 deletions(-) diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c index 9c219b5ddb..333fb3d79b 100644 --- a/libavcodec/ffv1.c +++ b/libavcodec/ffv1.c @@ -214,6 +214,8 @@ av_cold int ff_ffv1_close(AVCodecContext *avctx) ff_refstruct_unref(&sc->plane); } + ff_refstruct_unref(&s->slice_damaged); + av_freep(&avctx->stats_out); for (j = 0; j < s->quant_table_count; j++) { av_freep(&s->initial_states[j]); diff --git a/libavcodec/ffv1.h b/libavcodec/ffv1.h index edc3f6aef0..92c629c823 100644 --- a/libavcodec/ffv1.h +++ b/libavcodec/ffv1.h @@ -118,7 +118,6 @@ typedef struct FFV1Context { int64_t picture_number; int key_frame; ProgressFrame picture, last_picture; - struct FFV1Context *fsrc; const AVFrame *cur_enc_frame; int plane_count; @@ -148,6 +147,14 @@ typedef struct FFV1Context { int num_h_slices; FFV1SliceContext *slices; + /* RefStruct object, per-slice damage flags shared between frame threads. + * + * After a frame thread marks some slice as finished with + * ff_progress_frame_report(), the corresponding array element must not be + * accessed by this thread anymore, as from then on it is owned by the next + * thread. + */ + uint8_t *slice_damaged; } FFV1Context; int ff_ffv1_common_init(AVCodecContext *avctx); diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index 5821a4156a..a69f18e252 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -263,15 +263,10 @@ static int decode_slice(AVCodecContext *c, void *arg) const int si = sc - f->slices; GetBitContext gb; - if (f->fsrc && !(p->flags & AV_FRAME_FLAG_KEY) && f->last_picture.f) + if (!(p->flags & AV_FRAME_FLAG_KEY) && f->last_picture.f) ff_progress_frame_await(&f->last_picture, si); - if (f->fsrc) { - const FFV1SliceContext *scsrc = &f->fsrc->slices[si]; - - if (!(p->flags & AV_FRAME_FLAG_KEY)) - sc->slice_damaged |= scsrc->slice_damaged; - } + sc->slice_damaged |= f->slice_damaged[si]; sc->slice_rct_by_coef = 1; sc->slice_rct_ry_coef = 1; @@ -373,6 +368,8 @@ handle_damage: sc->slice_height); } + f->slice_damaged[si] = sc->slice_damaged; + ff_progress_frame_report(&f->picture, si); return 0; @@ -793,11 +790,14 @@ static int read_header(FFV1Context *f) return AVERROR_INVALIDDATA; } + ff_refstruct_unref(&f->slice_damaged); + f->slice_damaged = ff_refstruct_allocz(f->slice_count * sizeof(*f->slice_damaged)); + if (!f->slice_damaged) + return AVERROR(ENOMEM); + for (int j = 0; j < f->slice_count; j++) { FFV1SliceContext *sc = &f->slices[j]; - sc->slice_damaged = 0; - if (f->version == 2) { int sx = get_symbol(c, state, 0); int sy = get_symbol(c, state, 0); @@ -945,6 +945,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, int trailer = 3 + 5*!!f->ec; int v; + sc->slice_damaged = 0; + if (i || f->version > 2) { if (trailer > buf_p - buf) v = INT_MAX; else v = AV_RB24(buf_p-trailer) + trailer; @@ -1039,8 +1041,6 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src) FFV1SliceContext *sc = &fdst->slices[i]; const FFV1SliceContext *sc0 = &fsrc->slices[i]; - sc->slice_damaged = sc0->slice_damaged; - ff_refstruct_replace(&sc->plane, sc0->plane); if (fsrc->version < 3) { @@ -1051,12 +1051,12 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src) } } + ff_refstruct_replace(&fdst->slice_damaged, fsrc->slice_damaged); + av_assert1(fdst->max_slice_count == fsrc->max_slice_count); ff_progress_frame_replace(&fdst->picture, &fsrc->picture); - fdst->fsrc = fsrc; - return 0; } #endif