Find a file
Patrick Lerda 7f9cf7fcdd winsys/radeon: fix radeon_winsys_bo_from_handle() related race condition
This change prevents the reuse of the bo when the counter is already
zero. At zero, the bo is in a state where the deletion is pending,
and this implementation relying on an atomic counter can't be safely
stopped. In other words, the previous fix ccd3bb4548 lower the
probability of this race condition, but doesn't fix it.

This change prevents a race condition which has a high probability
on r600 with the test below. This change was tested with the thread
sanitizer.

For instance, this issue is triggered on r600 with
"piglit/bin/ext_image_dma_buf_import-refcount-multithread -auto":
==9876==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000021a20 at pc 0x7f2c9f59f748 bp 0x7f2c8f3aa600 sp 0x7f2c8f3aa5f8
READ of size 4 at 0x60d000021a20 thread T6
    #0 0x7f2c9f59f747 in pipe_is_referenced ../src/gallium/auxiliary/util/u_inlines.h:65
    #1 0x7f2c9f59f747 in radeon_bo_destroy ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:342
    #2 0x7f2c9f63b541 in radeon_bo_reference ../src/gallium/include/winsys/radeon_winsys.h:794
    #3 0x7f2c9f63b541 in r600_texture_destroy ../src/gallium/drivers/r600/r600_texture.c:571
    #4 0x7f2c9d65662d in pipe_resource_destroy ../src/gallium/auxiliary/util/u_inlines.h:146
    #5 0x7f2c9d65662d in pipe_resource_reference ../src/gallium/auxiliary/util/u_inlines.h:163
    #6 0x7f2c9d65662d in st_FreeTextureImageBuffer ../src/mesa/state_tracker/st_cb_texture.c:459
    #7 0x7f2c9d5b6991 in _mesa_delete_texture_image ../src/mesa/main/teximage.c:226
    #8 0x7f2c9d5f2593 in _mesa_delete_texture_object ../src/mesa/main/texobj.c:532
    #9 0x7f2c9d5f2be7 in _mesa_reference_texobj_ ../src/mesa/main/texobj.c:639
    #10 0x7f2c9d5f3773 in _mesa_reference_texobj ../src/mesa/main/texobj.h:92
    #11 0x7f2c9d5f3773 in delete_textures ../src/mesa/main/texobj.c:1578

0x60d000021a20 is located 0 bytes inside of 144-byte region [0x60d000021a20,0x60d000021ab0)
freed by thread T5 here:
    #0 0x7f2ca8b2b4f7 in free (/usr/lib64/libasan.so.6+0xb14f7)
    #1 0x7f2c9f59efb3 in radeon_bo_destroy ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:401
    #2 0x7f2c9f63b541 in radeon_bo_reference ../src/gallium/include/winsys/radeon_winsys.h:794
    #3 0x7f2c9f63b541 in r600_texture_destroy ../src/gallium/drivers/r600/r600_texture.c:571
    #4 0x7f2c9d65662d in pipe_resource_destroy ../src/gallium/auxiliary/util/u_inlines.h:146
    #5 0x7f2c9d65662d in pipe_resource_reference ../src/gallium/auxiliary/util/u_inlines.h:163
    #6 0x7f2c9d65662d in st_FreeTextureImageBuffer ../src/mesa/state_tracker/st_cb_texture.c:459
    #7 0x7f2c9d5b6991 in _mesa_delete_texture_image ../src/mesa/main/teximage.c:226
    #8 0x7f2c9d5f2593 in _mesa_delete_texture_object ../src/mesa/main/texobj.c:532
    #9 0x7f2c9d5f2be7 in _mesa_reference_texobj_ ../src/mesa/main/texobj.c:639
    #10 0x7f2c9d5f3773 in _mesa_reference_texobj ../src/mesa/main/texobj.h:92
    #11 0x7f2c9d5f3773 in delete_textures ../src/mesa/main/texobj.c:1578

previously allocated by thread T6 here:
    #0 0x7f2ca8b2b9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7)
    #1 0x7f2c9f5a36d5 in radeon_winsys_bo_from_handle ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1198
    #2 0x7f2c9f641b2a in r600_texture_from_handle ../src/gallium/drivers/r600/r600_texture.c:1105
    #3 0x7f2c9d47550a in dri_create_image_from_winsys ../src/gallium/frontends/dri/dri2.c:1007
    #4 0x7f2c9d47eeb9 in dri2_from_dma_bufs ../src/gallium/frontends/dri/dri2.c:1629
    #5 0x7f2ca8854360 in dri2_create_image_dma_buf ../src/egl/drivers/dri2/egl_dri2.c:2564
    #6 0x7f2ca8854f45 in dri2_create_image_khr ../src/egl/drivers/dri2/egl_dri2.c:2817
    #7 0x7f2ca8846f2c in dri2_create_image ../src/egl/drivers/dri2/egl_dri2.c:1864
    #8 0x7f2ca87f9dd8 in _eglCreateImageCommon ../src/egl/main/eglapi.c:1850

Fixes: ccd3bb4548 ("winsys/radeon: fix a race between bo import and destroy")
Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
(cherry picked from commit c6bcf88949)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/33113>
2025-01-08 09:18:52 -08:00
.ci-farms Revert "ci: disable ondracka farm" 2024-11-06 16:38:47 +00:00
.ci-farms-disabled Revert "ci: disable ondracka farm" 2024-11-06 16:38:47 +00:00
.github/workflows add zink to macos ci 2022-11-22 19:04:13 +00:00
.gitlab gitlab: Reference hang debugging documenttion 2024-05-16 09:47:53 +00:00
.gitlab-ci ci/b2c: run the machine registration check before the test container 2025-01-02 10:03:48 -08:00
android Android15 support gralloc IMapper5 2024-10-29 12:32:04 +00:00
bin meson/megadriver: support various lib suffixes 2024-12-02 13:44:17 -08:00
build-support meson: move tsan-blacklist.txt to build-support with the other build support files 2024-05-01 07:05:12 +00:00
docs docs: Add SHA sums to 24.3.3 release notes 2025-01-03 09:58:39 -08:00
include intel/pci_ids: Update DG1 device names 2024-11-05 22:14:04 +00:00
src winsys/radeon: fix radeon_winsys_bo_from_handle() related race condition 2025-01-08 09:18:52 -08:00
subprojects meson: Update wayland-protocols to 1.38 2024-11-07 00:03:23 +00:00
.clang-format meson: enable the clang-format target 2023-05-29 11:57:08 +00:00
.clang-format-ignore ci: enforce formatting for RADV & ACO 2023-06-16 19:59:52 +00:00
.clang-format-include r300: opt in to clang-format CI enforcement for the compiler 2024-10-15 09:24:02 +00:00
.dir-locals.el
.editorconfig glsl: Fixes ident issue in glsl_parser.yy and update editorconfig for it 2022-12-16 19:02:17 +00:00
.git-blame-ignore-revs freedreno: Add reformatting commits to .git-blame-ignore-revs 2023-09-22 02:07:36 +00:00
.gitattributes gitlab: Highlight .cl as C 2023-11-02 11:37:46 +00:00
.gitignore .gitignore: add .cache folder 2024-05-13 14:32:12 +00:00
.gitlab-ci.yml ci: raise priority of release manager pipelines 2024-11-13 08:31:00 -08:00
.graphqlrc.yml ci/bin: Add utility to find jobs dependencies 2022-08-03 23:10:37 +00:00
.mailmap mailmap: update rohan's primary email address 2024-06-19 09:06:15 +00:00
.mr-label-maker.yml mr-label-maker: add gfxstream 2024-09-26 18:53:58 +00:00
.pick_status.json winsys/radeon: fix radeon_winsys_bo_from_handle() related race condition 2025-01-08 09:18:52 -08:00
.shellcheckrc ci: move shellcheck options to .shellcheckrc 2024-10-24 22:43:03 +00:00
CODEOWNERS CODEOWNERS: update Imagination maintainers 2024-01-19 10:26:15 +00:00
meson.build meson/megadriver: support various lib suffixes 2024-12-02 13:44:17 -08:00
meson_options.txt meson: remove selinux option 2024-10-21 01:14:35 +00:00
README.rst docs: Match README installation guide with meson.rst 2024-07-27 11:53:53 +00:00
VERSION VERSION: bump for 24.3.3 release 2025-01-03 09:37:20 -08:00

`Mesa <https://mesa3d.org>`_ - The 3D Graphics Library
======================================================


Source
------

This repository lives at https://gitlab.freedesktop.org/mesa/mesa.
Other repositories are likely forks, and code found there is not supported.


Build & install
---------------

You can find more information in our documentation (`docs/install.rst
<https://docs.mesa3d.org/install.html>`_), but the recommended way is to use
Meson (`docs/meson.rst <https://docs.mesa3d.org/meson.html>`_):

.. code-block:: sh

  $ meson setup build
  $ ninja -C build/
  $ sudo ninja -C build/ install

Support
-------

Many Mesa devs hang on IRC; if you're not sure which channel is
appropriate, you should ask your question on `OFTC's #dri-devel
<irc://irc.oftc.net/dri-devel>`_, someone will redirect you if
necessary.
Remember that not everyone is in the same timezone as you, so it might
take a while before someone qualified sees your question.
To figure out who you're talking to, or which nick to ping for your
question, check out `Who's Who on IRC
<https://dri.freedesktop.org/wiki/WhosWho/>`_.

The next best option is to ask your question in an email to the
mailing lists: `mesa-dev\@lists.freedesktop.org
<https://lists.freedesktop.org/mailman/listinfo/mesa-dev>`_


Bug reports
-----------

If you think something isn't working properly, please file a bug report
(`docs/bugs.rst <https://docs.mesa3d.org/bugs.html>`_).


Contributing
------------

Contributions are welcome, and step-by-step instructions can be found in our
documentation (`docs/submittingpatches.rst
<https://docs.mesa3d.org/submittingpatches.html>`_).

Note that Mesa uses gitlab for patches submission, review and discussions.