Find a file
Patrick Lerda c6bcf88949 winsys/radeon: fix radeon_winsys_bo_from_handle() related race condition
This change prevents the reuse of the bo when the counter is already
zero. At zero, the bo is in a state where the deletion is pending,
and this implementation relying on an atomic counter can't be safely
stopped. In other words, the previous fix ccd3bb4548 lower the
probability of this race condition, but doesn't fix it.

This change prevents a race condition which has a high probability
on r600 with the test below. This change was tested with the thread
sanitizer.

For instance, this issue is triggered on r600 with
"piglit/bin/ext_image_dma_buf_import-refcount-multithread -auto":
==9876==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000021a20 at pc 0x7f2c9f59f748 bp 0x7f2c8f3aa600 sp 0x7f2c8f3aa5f8
READ of size 4 at 0x60d000021a20 thread T6
    #0 0x7f2c9f59f747 in pipe_is_referenced ../src/gallium/auxiliary/util/u_inlines.h:65
    #1 0x7f2c9f59f747 in radeon_bo_destroy ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:342
    #2 0x7f2c9f63b541 in radeon_bo_reference ../src/gallium/include/winsys/radeon_winsys.h:794
    #3 0x7f2c9f63b541 in r600_texture_destroy ../src/gallium/drivers/r600/r600_texture.c:571
    #4 0x7f2c9d65662d in pipe_resource_destroy ../src/gallium/auxiliary/util/u_inlines.h:146
    #5 0x7f2c9d65662d in pipe_resource_reference ../src/gallium/auxiliary/util/u_inlines.h:163
    #6 0x7f2c9d65662d in st_FreeTextureImageBuffer ../src/mesa/state_tracker/st_cb_texture.c:459
    #7 0x7f2c9d5b6991 in _mesa_delete_texture_image ../src/mesa/main/teximage.c:226
    #8 0x7f2c9d5f2593 in _mesa_delete_texture_object ../src/mesa/main/texobj.c:532
    #9 0x7f2c9d5f2be7 in _mesa_reference_texobj_ ../src/mesa/main/texobj.c:639
    #10 0x7f2c9d5f3773 in _mesa_reference_texobj ../src/mesa/main/texobj.h:92
    #11 0x7f2c9d5f3773 in delete_textures ../src/mesa/main/texobj.c:1578

0x60d000021a20 is located 0 bytes inside of 144-byte region [0x60d000021a20,0x60d000021ab0)
freed by thread T5 here:
    #0 0x7f2ca8b2b4f7 in free (/usr/lib64/libasan.so.6+0xb14f7)
    #1 0x7f2c9f59efb3 in radeon_bo_destroy ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:401
    #2 0x7f2c9f63b541 in radeon_bo_reference ../src/gallium/include/winsys/radeon_winsys.h:794
    #3 0x7f2c9f63b541 in r600_texture_destroy ../src/gallium/drivers/r600/r600_texture.c:571
    #4 0x7f2c9d65662d in pipe_resource_destroy ../src/gallium/auxiliary/util/u_inlines.h:146
    #5 0x7f2c9d65662d in pipe_resource_reference ../src/gallium/auxiliary/util/u_inlines.h:163
    #6 0x7f2c9d65662d in st_FreeTextureImageBuffer ../src/mesa/state_tracker/st_cb_texture.c:459
    #7 0x7f2c9d5b6991 in _mesa_delete_texture_image ../src/mesa/main/teximage.c:226
    #8 0x7f2c9d5f2593 in _mesa_delete_texture_object ../src/mesa/main/texobj.c:532
    #9 0x7f2c9d5f2be7 in _mesa_reference_texobj_ ../src/mesa/main/texobj.c:639
    #10 0x7f2c9d5f3773 in _mesa_reference_texobj ../src/mesa/main/texobj.h:92
    #11 0x7f2c9d5f3773 in delete_textures ../src/mesa/main/texobj.c:1578

previously allocated by thread T6 here:
    #0 0x7f2ca8b2b9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7)
    #1 0x7f2c9f5a36d5 in radeon_winsys_bo_from_handle ../src/gallium/winsys/radeon/drm/radeon_drm_bo.c:1198
    #2 0x7f2c9f641b2a in r600_texture_from_handle ../src/gallium/drivers/r600/r600_texture.c:1105
    #3 0x7f2c9d47550a in dri_create_image_from_winsys ../src/gallium/frontends/dri/dri2.c:1007
    #4 0x7f2c9d47eeb9 in dri2_from_dma_bufs ../src/gallium/frontends/dri/dri2.c:1629
    #5 0x7f2ca8854360 in dri2_create_image_dma_buf ../src/egl/drivers/dri2/egl_dri2.c:2564
    #6 0x7f2ca8854f45 in dri2_create_image_khr ../src/egl/drivers/dri2/egl_dri2.c:2817
    #7 0x7f2ca8846f2c in dri2_create_image ../src/egl/drivers/dri2/egl_dri2.c:1864
    #8 0x7f2ca87f9dd8 in _eglCreateImageCommon ../src/egl/main/eglapi.c:1850

Fixes: ccd3bb4548 ("winsys/radeon: fix a race between bo import and destroy")
Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32896>
2025-01-07 02:38:15 +00:00
.ci-farms svga/ci: enable vmware farm 2025-01-06 22:46:02 +00:00
.ci-farms-disabled svga/ci: enable vmware farm 2025-01-06 22:46:02 +00:00
.github/workflows add zink to macos ci 2022-11-22 19:04:13 +00:00
.gitlab gitlab: Reference hang debugging documenttion 2024-05-16 09:47:53 +00:00
.gitlab-ci ci/android: upgrade DEBIAN_TEST_ANDROID_TAG 2025-01-02 19:31:41 +00:00
.marge/hooks ci: move pipeline_summary tool to .marge/hooks 2024-12-02 19:22:59 -08:00
android Android15 support gralloc IMapper5 2024-10-29 12:32:04 +00:00
bin ci: update_traces_checksum: fix E501 line too long 2024-12-23 20:47:16 +00:00
build-support meson: move tsan-blacklist.txt to build-support with the other build support files 2024-05-01 07:05:12 +00:00
docs lavapipe: Advertise vulkan 1.4 2025-01-06 20:30:34 +00:00
include include: Update the OpenCL headers to latest 2025-01-03 18:26:19 +00:00
src winsys/radeon: fix radeon_winsys_bo_from_handle() related race condition 2025-01-07 02:38:15 +00:00
subprojects meson: Update wayland-protocols to 1.38 2024-11-07 00:03:23 +00:00
.clang-format meson: enable the clang-format target 2023-05-29 11:57:08 +00:00
.clang-format-ignore ci: enforce formatting for RADV & ACO 2023-06-16 19:59:52 +00:00
.clang-format-include r300: opt in to clang-format CI enforcement for the compiler 2024-10-15 09:24:02 +00:00
.dir-locals.el
.editorconfig glsl: Fixes ident issue in glsl_parser.yy and update editorconfig for it 2022-12-16 19:02:17 +00:00
.git-blame-ignore-revs ir3: add reformatting commits to .git-blame-ignore-revs 2024-12-02 16:44:50 +00:00
.gitattributes gitlab: Highlight .cl as C 2023-11-02 11:37:46 +00:00
.gitignore .gitignore: add .cache folder 2024-05-13 14:32:12 +00:00
.gitlab-ci.yml ci/android: add a script to build LLVM libraries for Android 2024-12-20 04:40:52 +00:00
.graphqlrc.yml ci/bin: Add utility to find jobs dependencies 2022-08-03 23:10:37 +00:00
.mailmap mailmap: update rohan's primary email address 2024-06-19 09:06:15 +00:00
.mr-label-maker.yml mr-label-maker: Rules for intel/executor 2024-12-04 19:14:02 +00:00
.shellcheckrc ci: move shellcheck options to .shellcheckrc 2024-10-24 22:43:03 +00:00
CODEOWNERS CODEOWNERS: update for new pco compiler tree 2024-11-29 15:14:12 +00:00
meson.build meson: Add precomp-compiler and install-precomp-compiler options 2024-12-23 15:09:41 +00:00
meson_options.txt meson: Add precomp-compiler and install-precomp-compiler options 2024-12-23 15:09:41 +00:00
README.rst docs: Match README installation guide with meson.rst 2024-07-27 11:53:53 +00:00
rustfmt.toml mesa: Add rustfmt.toml 2024-11-18 22:29:14 +00:00
VERSION VERSION: bump to 25.0 2024-11-07 17:57:57 +00:00

`Mesa <https://mesa3d.org>`_ - The 3D Graphics Library
======================================================


Source
------

This repository lives at https://gitlab.freedesktop.org/mesa/mesa.
Other repositories are likely forks, and code found there is not supported.


Build & install
---------------

You can find more information in our documentation (`docs/install.rst
<https://docs.mesa3d.org/install.html>`_), but the recommended way is to use
Meson (`docs/meson.rst <https://docs.mesa3d.org/meson.html>`_):

.. code-block:: sh

  $ meson setup build
  $ ninja -C build/
  $ sudo ninja -C build/ install

Support
-------

Many Mesa devs hang on IRC; if you're not sure which channel is
appropriate, you should ask your question on `OFTC's #dri-devel
<irc://irc.oftc.net/dri-devel>`_, someone will redirect you if
necessary.
Remember that not everyone is in the same timezone as you, so it might
take a while before someone qualified sees your question.
To figure out who you're talking to, or which nick to ping for your
question, check out `Who's Who on IRC
<https://dri.freedesktop.org/wiki/WhosWho/>`_.

The next best option is to ask your question in an email to the
mailing lists: `mesa-dev\@lists.freedesktop.org
<https://lists.freedesktop.org/mailman/listinfo/mesa-dev>`_


Bug reports
-----------

If you think something isn't working properly, please file a bug report
(`docs/bugs.rst <https://docs.mesa3d.org/bugs.html>`_).


Contributing
------------

Contributions are welcome, and step-by-step instructions can be found in our
documentation (`docs/submittingpatches.rst
<https://docs.mesa3d.org/submittingpatches.html>`_).

Note that Mesa uses gitlab for patches submission, review and discussions.