fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 09:18:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

iris: Set BO maps to NULL in bo_free

Browse source 
bo_free is called on external BOs when there are no objects left which
reference them. The function unmaps the address range associated with
any maps which occured. However, if the BO is busy (not idle), it
doesn't mark the pointer to the start address as invalid. This can lead
to a segfault later on.

At the end of bo_free, these BOs are still present in the handle hash
table. If such a BO is reused (i.e., when a DMABUF with the same handle
is reimported) and the driver attempts to get another mapping, the
bufmgr will incorrectly assume that the map pointer is still valid and
reuse it. This leads to a segfault. Set the pointer to NULL to mark it
as invalid.

Enables iris to run and pass the piglit test,
ext_image_dma_buf_import-reimport-bug.

Cc: mesa-stable
Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/9230>
(cherry picked from commit 0092219cfe)
This commit is contained in:
Nanley Chery 2021-02-22 10:54:30 -08:00 • committed by Dylan Baker
parent d150fc963d
commit c30215de7e
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -949,7 +949,7 @@
"description": "iris: Set BO maps to NULL in bo_free",
"nominated": true,
"nomination_type": 0,
"resolution": 0,
"resolution": 1,
"master_sha": null,
"because_sha": null
},

3
src/gallium/drivers/iris/iris_bufmgr.c
View file

@ -798,14 +798,17 @@ bo_free(struct iris_bo *bo)
if (bo->map_cpu && !bo->userptr) {
VG_NOACCESS(bo->map_cpu, bo->size);
os_munmap(bo->map_cpu, bo->size);
bo->map_cpu = NULL;
}
if (bo->map_wc) {
VG_NOACCESS(bo->map_wc, bo->size);
os_munmap(bo->map_wc, bo->size);
bo->map_wc = NULL;
}
if (bo->map_gtt) {
VG_NOACCESS(bo->map_gtt, bo->size);
os_munmap(bo->map_gtt, bo->size);
bo->map_gtt = NULL;
}
if (bo->idle) {