PR #23803 opened by HansKristian-Work URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23803 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23803.patch
Closes [#23802.](https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/23802) # Summary of changes Fixes a crash in Vulkan decode where a semaphore was waited on after it was destroyed. Reproducer is provided on the linked issue. The issue happens when the stream parameters are reset during decode. I did not reproduce a crash or VVL error in HEVC decode, but Lynne suggested the same fix should be made. AV1 decode didn't seem to have a similar ordering problem, so I left it alone. It did not reproduce any error either. >From 0cea3f45ca5e8c22d9078a5773c2fe3209256c4b Mon Sep 17 00:00:00 2001 From: Hans-Kristian Arntzen <[email protected]> Date: Tue, 14 Jul 2026 11:25:24 +0200 Subject: [PATCH 1/2] avcodec/h264: Ensure that private HW data is freed early for pictures. Vulkan video decode holds a reference to a VkSemaphore that is waited on in ff_vk_decode_free_frame. The bug manifests when a H264 stream changes resolution (or similar) where the stream needs to be reset in-flight. In this case, the wait_semaphores call ends up waiting on a destroyed semaphore, leading to segfaults in drivers. FFVulkanDecodePicture does not hold an owning reference to the semaphore, so destruction order matters in this case. Vulkan validation flags the error as waiting on an invalid semaphore. --- libavcodec/h264_picture.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/h264_picture.c b/libavcodec/h264_picture.c index aa3d2629c8..ce75b0cc89 100644 --- a/libavcodec/h264_picture.c +++ b/libavcodec/h264_picture.c @@ -44,9 +44,9 @@ void ff_h264_unref_picture(H264Picture *pic) if (!pic->f || !pic->f->buf[0]) return; + av_refstruct_unref(&pic->hwaccel_picture_private); ff_thread_release_ext_buffer(&pic->tf); av_frame_unref(pic->f_grain); - av_refstruct_unref(&pic->hwaccel_picture_private); av_refstruct_unref(&pic->qscale_table_base); av_refstruct_unref(&pic->mb_type_base); -- 2.52.0 >From 3eebfcbcfa39bc05ef19c15730c2adfb52082e1c Mon Sep 17 00:00:00 2001 From: Hans-Kristian Arntzen <[email protected]> Date: Tue, 14 Jul 2026 13:44:42 +0200 Subject: [PATCH 2/2] avcodec/hevc: Similar hwaccel_picture_private fix as h264. Lynne suggested that HEVC would have a similar bug. I couldn't reproduce a crash or VVL error in this area. av1_frame_unref seems to release hwaccel_picture_private early, and I couldn't reproduce any issues, so it's likely fine as-is. --- libavcodec/hevc/refs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc/refs.c b/libavcodec/hevc/refs.c index 005f416bf3..2df3a2ad56 100644 --- a/libavcodec/hevc/refs.c +++ b/libavcodec/hevc/refs.c @@ -38,6 +38,8 @@ void ff_hevc_unref_frame(HEVCFrame *frame, int flags) if (!(frame->flags & ~HEVC_FRAME_FLAG_CORRUPT)) frame->flags = 0; if (!frame->flags) { + av_refstruct_unref(&frame->hwaccel_picture_private); + ff_progress_frame_unref(&frame->tf); av_frame_unref(frame->frame_grain); frame->needs_fg = 0; @@ -49,8 +51,6 @@ void ff_hevc_unref_frame(HEVCFrame *frame, int flags) frame->nb_rpl_elems = 0; av_refstruct_unref(&frame->rpl_tab); frame->refPicList = NULL; - - av_refstruct_unref(&frame->hwaccel_picture_private); } } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
