fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-06 15:58:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

zink: Guard bo map/unmap on map_count.

Browse source 
Otherwise zink_bo_map can return cpu_ptr being destroyed by zink_bo_unmap.

Cc: mesa-stable
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41127>
This commit is contained in:
Derek Lesho 2026-04-23 11:14:44 +02:00 • committed by Marge Bot
parent f9f60aa844
commit ce45069c49
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/gallium/drivers/zink/zink_bo.c
View file

@ -707,8 +707,8 @@ zink_bo_map(struct zink_screen *screen, struct zink_bo *bo)
offset = bo->offset - real->offset;
}
p_atomic_inc(&real->u.real.map_count);
cpu = p_atomic_read(&real->u.real.cpu_ptr);
if (p_atomic_inc_return(&real->u.real.map_count) > 1)
cpu = p_atomic_read(&real->u.real.cpu_ptr);
if (!cpu) {
simple_mtx_lock(&real->lock);
/* Must re-check due to the possibility of a race. Re-check need not
@ -743,12 +743,15 @@ zink_bo_unmap(struct zink_screen *screen, struct zink_bo *bo)
if (p_atomic_dec_zero(&real->u.real.map_count)) {
simple_mtx_lock(&real->lock);
p_atomic_set(&real->u.real.cpu_ptr, NULL);
if (unlikely(zink_debug & ZINK_DEBUG_MAP)) {
p_atomic_add(&screen->mapped_vram, -real->base.base.size);
mesa_loge("UNMAP(%"PRIu64") TOTAL(%"PRIu64")", real->base.base.size, screen->mapped_vram);
/* Re-check in case of race with zink_bo_map */
if (!p_atomic_read(&real->u.real.map_count)) {
p_atomic_set(&real->u.real.cpu_ptr, NULL);
if (unlikely(zink_debug & ZINK_DEBUG_MAP)) {
p_atomic_add(&screen->mapped_vram, -real->base.base.size);
mesa_loge("UNMAP(%"PRIu64") TOTAL(%"PRIu64")", real->base.base.size, screen->mapped_vram);
}
VKSCR(UnmapMemory)(screen->dev, real->mem);
}
VKSCR(UnmapMemory)(screen->dev, real->mem);
simple_mtx_unlock(&real->lock);
}
}