freedreno/drm: Fix zombie BO import harder

Fixes: 6ac133c646dd ("freedreno/drm: Fix race in zombie import")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/26506>
(cherry picked from commit f2e3285d8e2b72e7408845afa5402ce48c4e93a8)

diff --git a/.pick_status.json b/.pick_status.json
index 9452d8c..73ed382 100644 (file)
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -404,7 +404,7 @@
         "description": "freedreno/drm: Fix zombie BO import harder",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "6ac133c646dd4f6f9d8f644b24da6aeae95c1ce3",
         "notes": null

diff --git a/src/freedreno/drm/freedreno_bo.c b/src/freedreno/drm/freedreno_bo.c
index 3c8ed16..7f4b57a 100644 (file)
--- a/src/freedreno/drm/freedreno_bo.c
+++ b/src/freedreno/drm/freedreno_bo.c
@@ -64,6 +64,15 @@ lookup_bo(struct hash_table *tbl, uint32_t key)
        * checking for refcnt==0 (ie. 1 after p_atomic_inc_return).
        */
       if (p_atomic_inc_return(&bo->refcnt) == 1) {
+         /* Restore the zombified reference count, so if another thread
+          * that ends up calling lookup_bo() gets the table_lock before
+          * the thread deleting the bo does, it doesn't mistakenly see
+          * that the BO is live.
+          *
+          * We are holding the table_lock here so we can't be racing
+          * with another caller of lookup_bo()
+          */
+         p_atomic_dec(&bo->refcnt);
          return &zombie;
       }