[Bug]: Mpv crash when using intel vaapi hwdec

[Kumoko4]

Which component impacted?

Decode

Is it regression? Good in old configuration?

None

What happened?

Launching a video in mpv with hwdec=auto-safe(in my case) leads to rare random segfaults with no particular pattern i noticed. I don't know if it's a regression or not since i only recently bough this GPU. Since crash is rare and i don't launch every video i watch with "export LIBVA_TRACE=/tmp/libva_trace.log mpv" i can't provide that log. I hope what i provided is enough to fix it.

What's the usage scenario when you are seeing the problem?

Playback

What impacted?

Regular playback of videos using hardware decoding e.g. mpv.

Debug Information

ls /dev/dri

by-path  card0  renderD128

dnf info libva libva-utils intel-gmmlib intel-media-driver | grep -E "Name|Version"

Name            : intel-gmmlib
Version         : 22.8.2
Name            : intel-media-driver
Version         : 25.3.4
Name            : libva
Version         : 2.22.0
Name            : libva
Version         : 2.22.0
Name            : libva-utils
Version         : 2.22.0
Name           : intel-gmmlib
Version        : 22.8.2
Name           : intel-media-driver
Version        : 25.3.4

vainfo >vainfo.log 2>&1

libva info: VA-API version 1.22.0
libva info: Trying to open /usr/lib64/dri-nonfree/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_22
libva info: va_openDriver() returns 0
Trying display: wayland
vainfo: VA-API version: 1.22 (libva 2.22.0)
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 25.3.4 ()
vainfo: Supported profile and entrypoints
      VAProfileNone                   :	VAEntrypointVideoProc
      VAProfileMPEG2Simple            :	VAEntrypointVLD
      VAProfileMPEG2Main              :	VAEntrypointVLD
      VAProfileH264Main               :	VAEntrypointVLD
      VAProfileH264Main               :	VAEntrypointEncSlice
      VAProfileH264High               :	VAEntrypointVLD
      VAProfileH264High               :	VAEntrypointEncSlice
      VAProfileJPEGBaseline           :	VAEntrypointVLD
      VAProfileJPEGBaseline           :	VAEntrypointEncPicture
      VAProfileH264ConstrainedBaseline:	VAEntrypointVLD
      VAProfileH264ConstrainedBaseline:	VAEntrypointEncSlice
      VAProfileVP8Version0_3          :	VAEntrypointVLD
      VAProfileHEVCMain               :	VAEntrypointVLD
      VAProfileHEVCMain               :	VAEntrypointEncSlice
      VAProfileHEVCMain10             :	VAEntrypointVLD
      VAProfileHEVCMain10             :	VAEntrypointEncSlice
      VAProfileVP9Profile0            :	VAEntrypointVLD
      VAProfileVP9Profile1            :	VAEntrypointVLD
      VAProfileVP9Profile2            :	VAEntrypointVLD
      VAProfileVP9Profile3            :	VAEntrypointVLD
      VAProfileHEVCMain12             :	VAEntrypointVLD
      VAProfileHEVCMain422_10         :	VAEntrypointVLD
      VAProfileHEVCMain422_10         :	VAEntrypointEncSlice
      VAProfileHEVCMain422_12         :	VAEntrypointVLD
      VAProfileHEVCMain444            :	VAEntrypointVLD
      VAProfileHEVCMain444            :	VAEntrypointEncSlice
      VAProfileHEVCMain444_10         :	VAEntrypointVLD
      VAProfileHEVCMain444_10         :	VAEntrypointEncSlice
      VAProfileHEVCMain444_12         :	VAEntrypointVLD
      VAProfileHEVCSccMain            :	VAEntrypointVLD
      VAProfileHEVCSccMain            :	VAEntrypointEncSlice
      VAProfileHEVCSccMain10          :	VAEntrypointVLD
      VAProfileHEVCSccMain10          :	VAEntrypointEncSlice
      VAProfileHEVCSccMain444         :	VAEntrypointVLD
      VAProfileHEVCSccMain444         :	VAEntrypointEncSlice
      VAProfileAV1Profile0            :	VAEntrypointVLD
      VAProfileAV1Profile0            :	VAEntrypointEncSlice
      VAProfileHEVCSccMain444_10      :	VAEntrypointVLD
      VAProfileHEVCSccMain444_10      :	VAEntrypointEncSlice

lspci -nn | grep -Ei 'VGA|DISPLAY'

03:00.0 VGA compatible controller [0300]: Intel Corporation Battlemage G21 [Arc B580] [8086:e20b]

Crash in dmesg:

 [106821.934212] vo[196716]: segfault at 10 ip 00007fb8bd45a40c sp 00007fb8c77f2f28 error 4 in iHD_drv_video.so[85a40c,7fb8bcc00000+a72000] likely on CPU 5 (core 5, socket 0)
[106821.934229] Code: 00 00 00 48 8d 3d 6d b9 23 00 e8 1f 34 81 ff eb bb 0f 1f 44 00 00 b8 05 00 00 00 c3 66 90 f3 0f 1e fa 48 8b 47 50 48 8b 40 60 <48> 8b 50 10 48 85 d2 74 33 8b 12 8b 40 1c 89 d1 29 c1 39 c2 72 06

Backtrace:

#0  MediaStatusReport::GetCompletedCount (this=<optimized out>, this=<optimized out>) at /usr/src/debug/intel-media-driver-25.3.4-1.fc43.x86_64/media_softlet/agnostic/common/shared/statusreport/media_status_report.h:174
No locals.
#1  decode::AvcPipelineXe_Lpm_Plus_Base::GetCompletedReport (this=0x558e9e6aa6f0)
    at /usr/src/debug/intel-media-driver-25.3.4-1.fc43.x86_64/media_softlet/agnostic/Xe_M_plus/Xe_LPM_plus_base/codec/hal/dec/avc/pipeline/decode_avc_pipeline_xe_lpm_plus_base.cpp:77
        trace = <optimized out>
        completedCount = <optimized out>
        reportedCount = <optimized out>
        __FUNCTION__ = <optimized out>
#2  DecodeAvcPipelineAdapterXe2_Hpm::GetCompletedReport (this=0x558e9e142080)
    at /usr/src/debug/intel-media-driver-25.3.4-1.fc43.x86_64/media_softlet/agnostic/Xe_M_plus/Xe2_HPM/codec/hal/dec/avc/pipeline/decode_avc_pipeline_adapter_xe2_hpm.cpp:124
No locals.
#3  0x00007fb8bceb6f67 in DdiDecodeFunctions::StatusReport (this=this@entry=0x7fb8b82a5ca0, mediaCtx=mediaCtx@entry=0x7fb8b80b1650, decoder=0x558e9e142080, surface=surface@entry=0x558e9de69f40)
    at /usr/src/debug/intel-media-driver-25.3.4-1.fc43.x86_64/media_softlet/linux/common/codec/ddi/dec/ddi_decode_functions.cpp:1049
        uNumCompletedReport = <optimized out>
#4  0x00007fb8bcebc7ff in DdiDecodeFunctions::StatusCheck (this=0x7fb8b82a5ca0, mediaCtx=0x7fb8b80b1650, surface=0x558e9de69f40, surfaceId=<optimized out>)
    at /usr/src/debug/intel-media-driver-25.3.4-1.fc43.x86_64/media_softlet/linux/common/codec/ddi/dec/ddi_decode_functions.cpp:1031
        i = 0
        decCtx = 0x558e9e329c80
        guard = {m_pMutex = 0x7fb8b80b1738}
        codecHal = <optimized out>
        decoder = <optimized out>
#5  0x00007fb934de68ba in vaSyncSurface (dpy=dpy@entry=0x7fb8b8059b30, render_target=<optimized out>) at ../va/va.c:1668
        va_status = 32697
        ctx = <optimized out>
        __func__ = "vaSyncSurface"
#6  0x0000558e89312dfe in mapper_map (mapper=0x7fb8b80ad4d0) at ../video/out/hwdec/hwdec_vaapi.c:321
        p_owner = 0x7fb8b8052070
        p = 0x7fb8b82a5d80
        status = 0
        display = 0x7fb8b8059b30
        desc = {fourcc = 842094158, width = 1920, height = 1088, num_objects = 1, objects = {{fd = 38, size = 3194880, drm_format_modifier = 72057594037927945}, {fd = 0, size = 0, drm_format_modifier = 0}, {fd = 0, size = 0, 
              drm_format_modifier = 0}, {fd = 0, size = 0, drm_format_modifier = 0}}, num_layers = 2, layers = {{drm_format = 538982482, num_planes = 1, object_index = {0, 0, 0, 0}, offset = {0, 0, 0, 0}, pitch = {1920, 0, 0, 0}}, {
              drm_format = 943215175, num_planes = 1, object_index = {0, 0, 0, 0}, offset = {2088960, 0, 0, 0}, pitch = {1920, 0, 0, 0}}, {drm_format = 0, num_planes = 0, object_index = {0, 0, 0, 0}, offset = {0, 0, 0, 0}, pitch = {0, 0, 
                0, 0}}, {drm_format = 0, num_planes = 0, object_index = {0, 0, 0, 0}, offset = {0, 0, 0, 0}, pitch = {0, 0, 0, 0}}}}
        flags = <optimized out>
        num_returned_planes = <optimized out>
#7  0x0000558e8928300a in ra_hwdec_mapper_map (mapper=0x7fb8b80ad4d0, img=0x558e9e25f650) at ../video/out/gpu/hwdec.c:172
No locals.
#8  0x0000558e892909cc in pass_upload_image (p=p@entry=0x7fb8b8154620, mpi=0x558e9e25f650, id=7252) at ../video/out/gpu/video.c:3725
        ok = <optimized out>
        perf = {last = 7516188671, avg = 2, peak = 30292, samples = {0, 0, 0, 1296236549, 140432881901664, 88, 0, 0, 0, 3, 2061584302080, 540, 0 <repeats 155 times>, 1, 1, 34359738368, 68719476864, 4294967304, 9277129363200, 4294967297, 
            9277129363200, 4294967297, 4294967297, 66846720, 131941395337216, 4294969456, 1, 33554625, 140431338775808, 0, 8589934592, 0 <repeats 19 times>, 4, 0, 1065353216, 0, 0, 0, 0, 1, 128, 1, 1, 30292, 0, 0, 0, 1, 0, 
            4575657221408423936, 0 <repeats 12 times>, 4294967296, 4294967297, 0, 0, 0, 0, 0, 140431340596776, 0, 0, 0, 0, 17483940831167051520, 1, 0, 140430867864608, 140431343684608, 0, 140433492934080, 140431597715824, 140431568536873, 
            1}, count = 0}
        vimg = 0x7fb8b8154c70
        using_pbo = <optimized out>
        mode = <optimized out>
        perf = {last = 7516188671, avg = 2, peak = 30292, samples = {0, 0, 0, 1296236549, 140432881901664, 88, 0, 0, 0, 3, 2061584302080, 540, 0 <repeats 155 times>, 1, 1, 34359738368, 68719476864, 4294967304, 9277129363200, 4294967297, 
            9277129363200, 4294967297, 4294967297, 66846720, 131941395337216, 4294969456, 1, 33554625, 140431338775808, 0, 8589934592, 0 <repeats 19 times>, 4, 0, 1065353216, 0, 0, 0, 0, 1, 128, 1, 1, 30292, 0, 0, 0, 1, 0, 
            4575657221408423936, 0 <repeats 12 times>, 4294967296, 4294967297, 0, 0, 0, 0, 0, 140431340596776, 0, 0, 0, 0, 17483940831167051520, 1, 0, 140430867864608, 140431343684608, 0, 140433492934080, 140431597715824, 140431568536873, 
            1}, count = 0}
        __PRETTY_FUNCTION__ = "pass_upload_image"
#9  0x0000558e89299f3b in pass_render_frame (p=p@entry=0x7fb8b8154620, mpi=<optimized out>, id=<optimized out>, flags=flags@entry=11) at ../video/out/gpu/video.c:3070
        vpts = <optimized out>
        vp_w = <optimized out>
        vp_h = <optimized out>
#10 0x0000558e8929c68f in gl_video_render_frame (p=0x7fb8b8154620, frame=0x7fb8952fe4e0, fbo=0x7fb8c77f4bc0, flags=11) at ../video/out/gpu/video.c:3452
        repeats = <optimized out>
        r = <optimized out>
        dest_fbo = <optimized out>
        fmt = <optimized out>
        is_new = <optimized out>
        src = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        dst = <optimized out>
        perf = <optimized out>
        interpolate = <optimized out>
        target_rc = {x0 = 0, y0 = 0, x1 = 3840, y1 = 2160}
        has_frame = true
        c = <optimized out>
        clear_color = {0, 0, 0, 1}
#11 0x0000558e892a0a80 in draw_frame (vo=0x558e9ddf86e0, frame=0x7fb8952fe4e0) at ../video/out/vo_gpu.c:82
        p = 0x558e9deff8a0
        sw = 0x7fb8b809c130
        fbo = {tex = 0x7fb8b8078aa0, flip = false, color_space = {primaries = PL_COLOR_PRIM_UNKNOWN, transfer = PL_COLOR_TRC_UNKNOWN, hdr = {prim = {red = {x = 0, y = 0}, green = {x = 0, y = 0}, blue = {x = 0, y = 0}, white = {x = 0, 
                  y = 0}}, min_luma = 0, max_luma = 0, max_cll = 0, max_fall = 0, scene_max = {0, 0, 0}, scene_avg = 0, ootf = {target_luma = 0, knee_x = 0, knee_y = 0, anchors = {0 <repeats 15 times>}, num_anchors = 0 '\000'}, 
              max_pq_y = 0, avg_pq_y = 0}}}
        params = <optimized out>
#12 0x0000558e892a6a18 in render_frame (vo=0x558e9ddf86e0) at ../video/out/vo.c:1010
        prev_drop_count = 0
        can_queue = false
        vsync = {last_queue_display_time = 106821, vsync_duration = 812079623, skipped_vsyncs = -1}
        in = <optimized out>
        frame = <optimized out>
        more_frames = false
        now = <optimized out>
        pts = <optimized out>
        duration = <optimized out>
        end_time = <optimized out>
        target = 201889618813
        use_vsync = <optimized out>
        request_redraw = false
        __PRETTY_FUNCTION__ = <optimized out>
#13 vo_thread (ptr=<optimized out>) at ../video/out/vo.c:1146
        working = <optimized out>
        wait_until = <optimized out>
        wakeup_on_done = <optimized out>
        send_reset = <optimized out>
        now = <optimized out>
        wakeup_core_after = <optimized out>
        redraw = <optimized out>
        send_pause = <optimized out>
        vo = <optimized out>
        in = <optimized out>
        vo_paused = false
        r = 0
#14 0x00007fb934c18464 in start_thread (arg=<optimized out>) at pthread_create.c:448
        ret = <optimized out>
        pd = <optimized out>
        out = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140431597758144, -126683455049335478, 140431597758144, 140722096682160, 0, 140722096682423, -126683455040946870, -126653379927114422}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 
              0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#15 0x00007fb934c9b5ec in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
No locals.

Do you want to contribute a patch to fix the issue?

No.

[Kumoko4]

libva_trace.log.180540.thd-0x00064d7f.txt
libva_trace.log.180540.thd-0x00064d65.txt

[Kumoko4]

I will not be submitting a formal Pull Request or signing the Developer Certificate of Origin (DCO). I am a user, not a legal clerk, and your strict requirement for real names and legal signatures is a major barrier to community contributions; it makes this repository feel like a graveyard while critical bugs for new hardware remain unfixed.

Ultimately, I value my privacy more than I value doing your work for you. If you want the driver to stop crashing on Battlemage cards, the fix is provided below. Take it as-is or reimplement the solution yourselves.
intel-media-driver-fix-xe2-segfault.patch

[Kumoko4]

To the assigned engineers:

I had once hoped for quick drivers updates. Gradually, I lost my patience.
I had once reported bugs. Gradually, I lost my expectation of a reply.
I had once grieved over my crashing hardware. Gradually, I became able to debug the assembly myself.
I had once rejoiced at the release of Battlemage. Gradually, I became unmoved by your marketing promises.

And now!

All I have left is an expressionless face, my gaze is as tough as a monolith, and only a working patch remains in my hands.

This is my own, an insignificant user's — Perseverance!

Why did I do your work for you? Because I realized a fundamental truth:

"There was no absolutely desperate situation in this world, there were only people who despair."

The answer to resolving problems will always be in our own hands; when we inspect our inner hearts, we will find that the miraculous heavenly power was in ourselves all along! To discover oneself, to recognize oneself, and to rely on oneself!

I relied on myself, debugged the assembly, and found the error you missed.

You sat comfortably, like the mantis stalking the cicada, unaware of the oriole behind (螳螂捕蝉，黄雀在后). You forgot that the world is full of hidden dragons and crouching tigers (卧虎藏龙).

You act like a frog at the bottom of a well (井底之蛙) and don't know the immensity of heaven and earth (不知天高地厚) if you think your internal validation covers the real world.

By missing this, you proved you have eyes but failed to see Mt. Tai (有眼不识泰山). It was but a tiny NULL pointer, yet a thousand-mile dike collapses because of an ant hole (千里之堤，溃于蚁穴). Your driver is the dike, and this bug is the ant hole.

You refused a toast, only to be forced to drink a forfeit (敬酒不吃吃罚酒). You ignored the warnings, and now a "mere user" has to fix your flagship driver.

I have paved the road. Walk it, or stumble.

If you choose to ignore a verified fix because of a missing signature, then truly 朽木不可雕也 (rotten wood cannot be carved).

I've done my part. The rest is your karma.