Segmentation fault in vchiq_lib.c

[exensor]

Describe the bug
Using gstreamer daemon ( https://developer.ridgerun.com/wiki/index.php?title=GStreamer_Daemon) with gstreamer 1.18.1 and omxh264 plugin to both decode and encode h264 streams on a raspberry pi3.

The source of the video is h264 rtsp streams from an axis video camera at 1080p 15fps.

Sometimes the gstreamer daemon crashes due to a segmentation fault. Resulting coredumps tells me that the crash occurs in vchiq_lib.c in alloc_msgbuf.

The offending line of code, according to gdb, is:

free_msgbufs = *(void **)msgbuf;

Backtrace:

#0  alloc_msgbuf () at /usr/src/debug/userland/20200624-r0/git/interface/vchiq_arm/vchiq_lib.c:1750
#1  0x72260a8e in completion_thread (arg=0x72273120 <vchiq_instance>) at /usr/src/debug/userland/20200624-r0/git/interface/vchiq_arm/vchiq_lib.c:1528
#2  0x72249ca0 in vcos_thread_entry (arg=0x72273130 <vchiq_instance+16>)
    at /usr/src/debug/userland/20200624-r0/git/interface/vcos/pthreads/vcos_pthreads.c:144
#3  0x46ec6974 in start_thread (arg=0xcb095d1a) at pthread_create.c:477
#4  0x46e5aefc in ?? () at ../sysdeps/unix/sysv/linux/arm/clone.S:73 from /dunfell-trunk/builds/rpi3/debugfs/lib/libc.so.6

To reproduce
I have sadly no real way of reproducing this bug. I have a testbench with apx. 10 rpi3 running the same gstreamer pipelines, and the majority of the time this never happens. But once or twice per week one or two of them dies. I have not been able to see any pattern and it happens on random units every time.

Expected behaviour
The system should decode and encode h264 without crashing.

Actual behaviour
The system sometimes crashes due to segfault in userland libaries.

System
Raspinfo not available on this yocto build.

• Which model of Raspberry Pi?

Raspberry Pi 3 Model B Rev 1.2 (compute module 3)

• Which OS and version (cat /etc/rpi-issue)?

Yocto dunfell.

• Which firmware version (vcgencmd version)?

Oct 2 2020 16:09:19
Copyright (c) 2012 Broadcom
version 4672d0274057d726f3a327e2b3fe76f831b811bb (clean) (release) (start)

• Which kernel version (uname -a)?

Linux Raspberry 5.4.72 #1 SMP PREEMPT Wed Nov 25 10:26:25 UTC 2020 armv7l GNU/Linux

Logs
dmesg contains no entries related to this. No other useful logs available.

Additional context
coredump of gstreamer daemon is available