[Xione/Glass UK][RDKV][VIPA 1.4.4.4][8.4p33s1] Observed "com.comcast.viper" crash with fingerprint- 61111371 contributing to OTTPENDING/BERR

middleware/drm/DrmSession.cpp

@@ -24,12 +24,17 @@
 
 #include "DrmSession.h"
 #include "PlayerLogManager.h"
+#include <chrono>
 
 /**
  * @brief Constructor for DrmSession.
  */
 DrmSession::DrmSession(const string &keySystem) : m_keySystem(keySystem),m_OutputProtectionEnabled(false)
 		, mContentSecurityManagerSession()
+		, mLifecycleMutex()
+		, mLifecycleCV()
+		, mActiveOperations(0)
+		, mMarkedForDestruction(false)
 {
 }
 
@@ -40,6 +45,55 @@ DrmSession::~DrmSession()
 {
 }
 
+/**
+ * @brief DELIA-70726 fix: Acquire lifecycle guard before use in decrypt().
+ */
+bool DrmSession::AcquireForUse()
+{
+	std::lock_guard<std::mutex> lock(mLifecycleMutex);
+	if (mMarkedForDestruction)
+	{
+		return false;
+	}
+	mActiveOperations++;
+	return true;
+}
+
+/**
+ * @brief DELIA-70726 fix: Release lifecycle guard after use in decrypt().
+ */
+void DrmSession::ReleaseAfterUse()
+{
+	std::lock_guard<std::mutex> lock(mLifecycleMutex);
+	if (mActiveOperations > 0)
+	{
+		mActiveOperations--;
+	}
+	if (mActiveOperations == 0)
+	{
+		mLifecycleCV.notify_all();
+	}
+}
+
+/**
+ * @brief DELIA-70726 fix: Block deletion of this session until any decrypt()
+ *        call already in progress (having acquired the guard) has finished.
+ */
+void DrmSession::PrepareForDestruction(uint32_t timeoutMs)
+{
+	std::unique_lock<std::mutex> lock(mLifecycleMutex);
+	mMarkedForDestruction = true;
+	if (mActiveOperations > 0)
+	{
+		MW_LOG_WARN("DrmSession::PrepareForDestruction : waiting for %d in-flight decrypt operation(s) to complete before delete", mActiveOperations);
+		mLifecycleCV.wait_for(lock, std::chrono::milliseconds(timeoutMs), [this]() { return mActiveOperations == 0; });
+		if (mActiveOperations > 0)
+		{
+			MW_LOG_ERR("DrmSession::PrepareForDestruction : timed out waiting for in-flight decrypt operation(s); proceeding with destruction");
+		}
+	}
+}
+
 /**
  * @brief Get the DRM System, ie, UUID for PlayReady WideVine etc..
  */
@@ -65,3 +119,14 @@ int DrmSession::decrypt(const uint8_t *f_pbIV, uint32_t f_cbIV, const uint8_t *p
 	MW_LOG_ERR("Standard decrypt method not implemented");
 	return -1;
 }
+
+/**
+ * @brief Get the list of usable key IDs from the DRM session
+ * @retval Reference to vector of usable key IDs
+ * @note Default implementation returns the reference to an empty vector
+ */
+const std::vector<std::vector<uint8_t>>& DrmSession::getUsableKeys() const
+{
+	static const std::vector<std::vector<uint8_t>> emptyVector;
+	return emptyVector;
+}

middleware/drm/DrmSession.h

@@ -29,6 +29,9 @@
 #include <stdint.h>
 #include <vector>
 #include <gst/gst.h>
+#include <atomic>
+#include <mutex>
+#include <condition_variable>
 #include "DrmUtils.h"
 #include "ContentSecurityManagerSession.h"
 
@@ -66,7 +69,53 @@ class DrmSession
 	std::string m_keySystem;
 	bool m_OutputProtectionEnabled;
 	ContentSecurityManagerSession mContentSecurityManagerSession;
+
+	/* DELIA-70726 fix:
+	 * Lifecycle guard used to prevent the DrmSession object from being
+	 * deleted (e.g. by DrmSessionManager during DRM session slot
+	 * reuse/eviction on back-to-back channel changes) while a GStreamer
+	 * pipeline thread (multiqueue/decryptor) is concurrently inside
+	 * decrypt()/verifyOutputProtection(). Without this guard, deletion of
+	 * a session that is still referenced by an old, not-yet-fully-torn-down
+	 * pipeline results in a use-after-free SIGSEGV inside
+	 * OCDMSessionAdapter::verifyOutputProtection().
+	 */
+	std::mutex mLifecycleMutex;
+	std::condition_variable mLifecycleCV;
+	int mActiveOperations;
+	bool mMarkedForDestruction;
+
 public:
+	/**
+	 * @fn AcquireForUse
+	 * @brief Must be called by any external caller (e.g. the GStreamer
+	 *        decryptor element) before invoking decrypt() on a DrmSession
+	 *        obtained via a raw/cached pointer. Returns false if the
+	 *        session is already being torn down, in which case decrypt()
+	 *        MUST NOT be called on this object.
+	 * @retval true if it is safe to call decrypt(), false otherwise.
+	 */
+	bool AcquireForUse();
+
+	/**
+	 * @fn ReleaseAfterUse
+	 * @brief Must be called exactly once for every successful AcquireForUse(),
+	 *        after the decrypt() call completes.
+	 */
+	void ReleaseAfterUse();
+
+	/**
+	 * @fn PrepareForDestruction
+	 * @brief Must be called by the owner (DrmSessionManager) before deleting
+	 *        this DrmSession. Marks the session so that any new
+	 *        AcquireForUse() calls fail fast, and blocks (bounded) until all
+	 *        in-flight decrypt() operations that already acquired the guard
+	 *        have completed, making it safe to free the object.
+	 * @param timeoutMs maximum time to wait for in-flight operations to drain.
+	 */
+	void PrepareForDestruction(uint32_t timeoutMs = 3000);
+
+
 	/**
 	 * @brief Create drm session with given init data
 	 * @param f_pbInitData : pointer to initdata
@@ -135,6 +184,13 @@ class DrmSession
 	 */
 	virtual void clearDecryptContext() = 0;
 
+	/**
+	 * @brief Get the list of usable key IDs from the DRM session
+	 * @retval Reference to vector of usable key IDs
+	 * @note Default implementation returns the reference to an empty vector
+	 */
+	virtual const std::vector<std::vector<uint8_t>>& getUsableKeys() const;
+
 	/**
 	 * @fn DrmSession
 	 * @param keySystem : DRM key system uuid