Skip to content

RDKEMW-21466: crash Observed in Vipa while zapping Linear channels#205

Merged
sankarimuthu merged 1 commit into
support/0.2.0_8.6from
feature/RDKEMW-21466
Jul 21, 2026
Merged

RDKEMW-21466: crash Observed in Vipa while zapping Linear channels#205
sankarimuthu merged 1 commit into
support/0.2.0_8.6from
feature/RDKEMW-21466

Conversation

@dp0000

@dp0000 dp0000 commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Adds a lifecycle guard to DrmSession — three new methods (AcquireForUse(), ReleaseAfterUse(), PrepareForDestruction()) using a mutex + condition variable to track in-flight decrypt operations and block deletion until they finish.

Guards every decrypt() call in the GStreamer decryptor plugin (gstcdmidecryptor.cpp) with AcquireForUse() / ReleaseAfterUse(), so the session can't be freed mid-operation.

Calls PrepareForDestruction() before every delete in DrmSessionManager (session clearing, slot reuse/eviction), ensuring any in-flight decrypt drains first .

Minor fix: a sinkCaps reference-counting tweak to avoid accessing freed caps after unlocking the mutex.

Copilot AI review requested due to automatic review settings July 17, 2026 10:58
@dp0000
dp0000 requested a review from a team as a code owner July 17, 2026 10:58

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to prevent a use-after-free crash during rapid linear channel zaps by introducing a lifecycle guard on DrmSession and applying it around GStreamer decrypt operations, while also ensuring session teardown attempts to wait for in-flight decrypt work to finish.

Changes:

  • Added DrmSession lifecycle-guard APIs (AcquireForUse(), ReleaseAfterUse(), PrepareForDestruction()) backed by a mutex/condition variable.
  • Wrapped GStreamer decrypt calls with acquire/release guard calls to avoid decrypt running concurrently with session teardown.
  • Updated DrmSessionManager deletion paths to call PrepareForDestruction() before deleting sessions; adjusted sink caps handling to avoid using freed caps after unlocking.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File Description
gst-plugins/drm/gst/gstcdmidecryptor.cpp Guards decrypt calls with AcquireForUse()/ReleaseAfterUse() and adjusts sink caps refcounting around unlock.
drm/DrmSessionManager.cpp Calls PrepareForDestruction() before deleting DrmSession instances in multiple teardown/eviction paths.
drm/DrmSession.h Adds lifecycle guard members and declares new lifecycle guard methods.
drm/DrmSession.cpp Implements lifecycle guard methods using mutex/condition_variable and bounded wait.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread drm/DrmSession.h
Comment thread drm/DrmSession.cpp
Comment thread drm/DrmSessionManager.cpp
Comment thread drm/DrmSessionManager.cpp
Comment thread drm/DrmSessionManager.cpp
@sankarimuthu
sankarimuthu merged commit d62dccb into support/0.2.0_8.6 Jul 21, 2026
6 checks passed
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 21, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants