From 851dda6d23fcfaa2258fcf22e783a89c2d493291 Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Fri, 19 Dec 2025 11:51:05 +0100 Subject: [PATCH 1/3] mesa: add assert to validate the no atomic path Comparing the ctx values and then updating the refcounts is not thread-safe so add an assert to make sure the ctx wasn't updated by another thread (via detach_ctx_from_buffer). --- src/mesa/main/bufferobj.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mesa/main/bufferobj.h b/src/mesa/main/bufferobj.h index 01833da8d6f..5277ee13637 100644 --- a/src/mesa/main/bufferobj.h +++ b/src/mesa/main/bufferobj.h @@ -161,15 +161,18 @@ _mesa_reference_buffer_object_(struct gl_context *ctx, /* Update the private ref count. */ assert(oldObj->CtxRefCount >= 1); oldObj->CtxRefCount--; + assert(oldObj->Ctx == ctx); } } if (bufObj) { /* reference new buffer */ - if (shared_binding || ctx != bufObj->Ctx) + if (shared_binding || ctx != bufObj->Ctx) { p_atomic_inc(&bufObj->RefCount); - else + } else { bufObj->CtxRefCount++; + assert(bufObj->Ctx == ctx); + } } *ptr = bufObj; From 34cfdb9971795dd9af8974b26ec8cc4e2985b59b Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Fri, 19 Dec 2025 11:47:44 +0100 Subject: [PATCH 2/3] Revert "glthread: mark internal bufferobjs for the ctx they belong to" This reverts commit 45b6aa1eb7ce0b3845567be7ee4349ab55f30043. This is not thread safe and will lead to buffer leaks, eg: [threadA] _mesa_reference_buffer_object_ ctx=0x60bc07fa33f0 buf=0x60bc09b90020 CtxRefCount-=993187 [threadB] _mesa_glthread_release_upload_buffer ctx=0x60bc07fa33f0 buf=0x60bc09b90020 ref=7768 CtxRefCount=993212 -> 954 [threadB] _mesa_glthread_upload ctx=0x60bc07fa33f0 buf=0x60bc09eb7d00 CtxRefCount=1000000 [threadA] _mesa_reference_buffer_object_ ctx=0x60bc07fa33f0 buf=0x60bc09b90020 CtxRefCount-=993186 ../src/mesa/main/bufferobj.h:201: _mesa_reference_buffer_object_: Assertion `oldObj->Ctx == ctx' failed. The assert is one added by the previous commit. Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14483 --- src/mesa/main/glthread_bufferobj.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/src/mesa/main/glthread_bufferobj.c b/src/mesa/main/glthread_bufferobj.c index a92ca40a860..09b0fbebbbc 100644 --- a/src/mesa/main/glthread_bufferobj.c +++ b/src/mesa/main/glthread_bufferobj.c @@ -25,8 +25,6 @@ #include "dispatch.h" #include "main/bufferobj.h" -#define PRIVATE_REFCOUNT 1000000 - /** * Create an upload buffer. This is called from the app thread, so everything * has to be thread-safe in the driver. @@ -81,11 +79,6 @@ _mesa_glthread_release_upload_buffer(struct gl_context *ctx, bool async_release) -glthread->upload_buffer_private_refcount); glthread->upload_buffer_private_refcount = 0; } - if (glthread->upload_buffer) { - glthread->upload_buffer->Ctx = NULL; - p_atomic_add(&glthread->upload_buffer->RefCount, - -(PRIVATE_REFCOUNT - glthread->upload_buffer->CtxRefCount)); - } if (async_release) { /* Defer to avoid calling tc_resource_release from this thread. */ @@ -163,8 +156,6 @@ _mesa_glthread_upload(struct gl_context *ctx, const void *data, */ glthread->upload_buffer->RefCount += default_size; glthread->upload_buffer_private_refcount = default_size; - glthread->upload_buffer->Ctx = ctx; - glthread->upload_buffer->CtxRefCount = PRIVATE_REFCOUNT; } /* Upload data. */ From b6dc57b755eb8bf294f50106b9f9ac5b77604740 Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Fri, 19 Dec 2025 13:26:31 +0100 Subject: [PATCH 3/3] ac/info: fix dev_filename printing readlink doesn't write a terminating null byte so only print the written bytes. --- src/amd/common/ac_gpu_info.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/amd/common/ac_gpu_info.c b/src/amd/common/ac_gpu_info.c index e0ca1a0f927..aef1f0d0b70 100644 --- a/src/amd/common/ac_gpu_info.c +++ b/src/amd/common/ac_gpu_info.c @@ -1678,8 +1678,9 @@ void ac_print_gpu_info(FILE *f, const struct radeon_info *info, int fd) char proc_fd[32]; char dev_filename[32]; snprintf(proc_fd, sizeof(proc_fd), "/proc/self/fd/%u", fd); - if (readlink(proc_fd, dev_filename, sizeof(dev_filename)) != -1) - fprintf(f, " dev_filename = %s\n", dev_filename); + int n = readlink(proc_fd, dev_filename, sizeof(dev_filename)); + if (n != -1) + fprintf(f, " dev_filename = %.*s\n", n, dev_filename); fprintf(f, " num_se = %i\n", info->num_se); fprintf(f, " num_rb = %i\n", info->num_rb);