rtpmanager/rtsession: data race leading to critical warnings
authorFrançois Laignel <francois@centricular.com>
Tue, 9 May 2023 15:28:49 +0000 (17:28 +0200)
committerGStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org>
Tue, 9 May 2023 22:35:23 +0000 (22:35 +0000)
commitb9f7ab60526af50fb2810e1bba19b0c511b9d52e
treec5621d22286198e834ce29882537185926639389
parent9f8d69540cb26c4c59d2b09a002b99d00dec9cd9
rtpmanager/rtsession: data race leading to critical warnings

This is a fix for a data race leading to:

> GLib-CRITICAL: g_hash_table_foreach:
>   assertion 'version == hash_table->version' failed

Identified sequence:

* `rtp_session_on_timeout` acquires the lock on `session` and proceeds with its
  processing.
* `rtp_session_process_rtcp` is called (debug log : received RTCP packet) and
  attempts to acquire the lock on `session`, which is still held by
  `rtp_session_on_timeout`.
* as part of an hash table iterator, `rtp_session_on_timeout` transitively
  invokes `source_caps` which releases the lock on `session` so as to call
  `session->callbacks.caps`.
* Since `rtp_session_process_rtcp` was waiting for the lock to be released, it
  succeeds in acquiring it and proceeds with `rtp_session_process_rr` which
  transitively calls `g_hash_table_insert` via `add_source`.
* After `source_caps` re-acquires the lock and gives the control flow back to
  `rtp_session_on_timeout`, the hash table iterator is changed, resulting in the
  assertion failure.

This commits copies `sess->ssrcs[sess->mask_idx]` and iterates on the copy so
the iterator is not affected by a concurrent change due to the lock being
released in the `source_caps` callback.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4585>
subprojects/gst-plugins-good/gst/rtpmanager/rtpsession.c