fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-24 17:30:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

freedreno/drm: Move pipe unref after fence removal

Browse source 
Dropping the final pipe ref could in turn drop the final ref to one
of a couple other bo's, which in turn could indirectly recurse back
into cleanup_fences() on the same bo, resulting in a double decrement
of bo->nr_fences and underflow to a large positive #.  This happens
because free'ing a bo back to the bo cache periodically calls
fd_bo_cache_cleanup() and any bo's that have not been re-used can
be really free'd, which in turn calls cleanup_fences().

Fixes: 7dabd62464 ("freedreno/drm: Userspace fences")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13263>
This commit is contained in:
Rob Clark 2021-10-07 16:59:53 -07:00 • committed by Marge Bot
parent a07bc0c37a
commit faed3d4dfe
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/freedreno/drm/freedreno_bo.c
View file

@ -320,7 +320,8 @@ cleanup_fences(struct fd_bo *bo, bool expired)
if (expired && fd_fence_before(f->pipe->control->fence, f->fence))
continue;
fd_pipe_del_locked(f->pipe);
struct fd_pipe *pipe = f->pipe;
bo->nr_fences--;
if (bo->nr_fences > 0) {
@ -328,6 +329,8 @@ cleanup_fences(struct fd_bo *bo, bool expired)
bo->fences[i] = bo->fences[bo->nr_fences];
i--;
}
fd_pipe_del_locked(pipe);
}
}