PR #22795 opened by nyanmisaka URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22795 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22795.patch
The multiplanar image with storage_bit enabled fails to be exported to DMA-BUF on the QCOM turnip driver, thus triggering this double-free issue. ``` [Parsed_hwmap_2 @ 0xffff5c002a70] Configure hwmap vulkan -> drm_prime. [hwmap @ 0xffff5c001180] Filter input: vulkan, 1920x1080 (0). [AVHWFramesContext @ 0xffff5c004e00] Unable to export the image as a FD! free(): double free detected in tcache 2 Aborted ``` ``` ffmpeg -init_hw_device drm=dr:/dev/dri/renderD128 \ -init_hw_device vulkan=vk@dr -filter_hw_device vk \ -f lavfi -i nullsrc=s=1920x1080,format=nv12 \ -vf hwupload,format=vulkan,hwmap,format=drm_prime -f null - ``` Additionally, add back an av_unused attribute. Otherwise, the compiler will complain about unused variables when CUDA is not enabled. Signed-off-by: nyanmisaka <[email protected]> >From ab7b6ef0a2c54c363abcb87b0df7b6f71d256f08 Mon Sep 17 00:00:00 2001 From: nyanmisaka <[email protected]> Date: Sun, 12 Apr 2026 20:50:38 +0800 Subject: [PATCH] hwcontext_vulkan: fix double free when vulkan_map_to_drm fails The multiplanar image with storage_bit enabled fails to be exported to DMA-BUF on the QCOM turnip driver, thus triggering this double-free issue. ``` [Parsed_hwmap_2 @ 0xffff5c002a70] Configure hwmap vulkan -> drm_prime. [hwmap @ 0xffff5c001180] Filter input: vulkan, 1920x1080 (0). [AVHWFramesContext @ 0xffff5c004e00] Unable to export the image as a FD! free(): double free detected in tcache 2 Aborted ``` Additionally, add back an av_unused attribute. Otherwise, the compiler will complain about unused variables when CUDA is not enabled. Signed-off-by: nyanmisaka <[email protected]> --- libavutil/hwcontext_vulkan.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libavutil/hwcontext_vulkan.c b/libavutil/hwcontext_vulkan.c index 16f286d1b8..929f6d9944 100644 --- a/libavutil/hwcontext_vulkan.c +++ b/libavutil/hwcontext_vulkan.c @@ -4248,7 +4248,7 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst, .sType = VK_STRUCTURE_TYPE_IMAGE_DRM_FORMAT_MODIFIER_PROPERTIES_EXT, }; const int nb_sems = nb_images; - + int free_drm_desc_on_err = 1; int sync_fd = -1; AVDRMFrameDescriptor *drm_desc = av_mallocz(sizeof(*drm_desc)); @@ -4286,6 +4286,9 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst, if (err < 0) goto end; + /* It will be freed in ff_hwframe_map_create callback */ + free_drm_desc_on_err = 0; + ret = vk->GetImageDrmFormatModifierPropertiesEXT(hwctx->act_dev, f->img[0], &drm_mod); if (ret != VK_SUCCESS) { @@ -4386,7 +4389,8 @@ static int vulkan_map_to_drm(AVHWFramesContext *hwfc, AVFrame *dst, end: for (int i = 0; i < drm_desc->nb_objects; i++) close(drm_desc->objects[i].fd); - av_free(drm_desc); + if (free_drm_desc_on_err) + av_free(drm_desc); if (sync_fd >= 0) close(sync_fd); return err; @@ -4868,7 +4872,7 @@ end: static int vulkan_transfer_data_to(AVHWFramesContext *hwfc, AVFrame *dst, const AVFrame *src) { - VulkanDevicePriv *p = hwfc->device_ctx->hwctx; + av_unused VulkanDevicePriv *p = hwfc->device_ctx->hwctx; switch (src->format) { #if CONFIG_CUDA -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
