fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-08 04:48:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

venus: fix a race condition between gem close and gem handle tracking

Browse source 
After using sparse array to manager virtgpu bo, we set gem_handle to 0
to indicate that the bo is invalid. However, the gem handle gets closed
before that and can be reused by another newly created bo, leading to
the tracked gem handle being unexpectedly zero'ed out.

Fixes: 88f481dd74 ("venus: make sure gem_handle and vn_renderer_bo are 1:1")
Signed-off-by: Yiwei Zhang <zzyiwei@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/30362>
(cherry picked from commit f788c87d02)
This commit is contained in:
Yiwei Zhang 2024-07-24 22:17:00 -07:00 • committed by Eric Engestrom
parent 5985125453
commit 5ab1aebd51
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -1284,7 +1284,7 @@
"description": "venus: fix a race condition between gem close and gem handle tracking",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "88f481dd7422f09ac28de50667fd36ad2ab5f891",
"notes": null

9
src/virtio/vulkan/vn_renderer_virtgpu.c
View file

@ -1111,10 +1111,15 @@ virtgpu_bo_destroy(struct vn_renderer *renderer, struct vn_renderer_bo *_bo)
if (bo->base.mmap_ptr)
munmap(bo->base.mmap_ptr, bo->base.mmap_size);
virtgpu_ioctl_gem_close(gpu, bo->gem_handle);
/* set gem_handle to 0 to indicate that the bo is invalid */
/* Set gem_handle to 0 to indicate that the bo is invalid. Must be set
* before closing gem handle. Otherwise the same gem handle can be reused
* by another newly created bo and unexpectedly gotten zero'ed out the
* tracked gem handle.
*/
const uint32_t gem_handle = bo->gem_handle;
bo->gem_handle = 0;
virtgpu_ioctl_gem_close(gpu, gem_handle);
mtx_unlock(&gpu->dma_buf_import_mutex);