fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-06-10 01:18:18 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

venus: fix unbound malloc leak in vn_ring_get_submits
Some checks are pending
macOS-CI / macOS-CI (dri) (push) Waiting to run
Details
macOS-CI / macOS-CI (xlib) (push) Waiting to run
Details

Browse source 
Credits to Toshinari Morikawa, and this supersedes
https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41904.

ring->free_submits can go unbound for heavy scenes that use 3 or more
shm pool allocs for CS storage. This change fixes to loop through the
free list for a cached entry, which is good enough in practice since
the most recently retired submit is cached at the list head.

Cc: mesa-stable
Reported-by: Toshinari Morikawa <morikawa.toshinari@jp.panasonic.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41917>
This commit is contained in:
Yiwei Zhang 2026-05-31 23:07:19 -07:00 • committed by Marge Bot
parent 9ec5e9a34e
commit 2cf1f6cb50
1 changed files with 10 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
src/virtio/vulkan/vn_ring.c
View file

@ -418,22 +418,18 @@ vn_ring_get_id(struct vn_ring *ring)
static struct vn_ring_submit *
vn_ring_get_submit(struct vn_ring *ring, uint32_t shmem_count)
{
const uint32_t min_shmem_count = 2;
struct vn_ring_submit *submit;
/* TODO this could be simplified if we could omit shmem_count */
if (shmem_count <= min_shmem_count &&
!list_is_empty(&ring->free_submits)) {
submit =
list_first_entry(&ring->free_submits, struct vn_ring_submit, head);
list_del(&submit->head);
} else {
const size_t submit_size = offsetof(
struct vn_ring_submit, shmems[MAX2(shmem_count, min_shmem_count)]);
submit = malloc(submit_size);
list_for_each_entry_safe(struct vn_ring_submit, submit,
&ring->free_submits, head) {
if (submit->shmem_count >= shmem_count) {
list_del(&submit->head);
return submit;
}
}
return submit;
const uint32_t min_shmem_count = 2;
const size_t submit_size = offsetof(
struct vn_ring_submit, shmems[MAX2(shmem_count, min_shmem_count)]);
return malloc(submit_size);
}
static bool