winsys/radeon: fix a race between bo import and destroy

This is similar to commit 85e74944c69 ("winsys/amdgpu: fix a race
between import and destroy") but for winsys/radeon.  In short, we need
to check the reference count again after bo_handles_mutex is held.

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25133>

diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
index 6ffeab7..c44811e 100644 (file)
--- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
+++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
@@ -338,6 +338,11 @@ void radeon_bo_destroy(void *winsys, struct pb_buffer *_buf)
    memset(&args, 0, sizeof(args));
 
    mtx_lock(&rws->bo_handles_mutex);
+   /* radeon_winsys_bo_from_handle might have revived the bo */
+   if (pipe_is_referenced(&bo->base.reference)) {
+      mtx_unlock(&rws->bo_handles_mutex);
+      return;
+   }
    _mesa_hash_table_remove_key(rws->bo_handles, (void*)(uintptr_t)bo->handle);
    if (bo->flink_name) {
       _mesa_hash_table_remove_key(rws->bo_names,
@@ -1191,8 +1196,7 @@ static struct pb_buffer *radeon_winsys_bo_from_handle(struct radeon_winsys *rws,
 
    if (bo) {
       /* Increase the refcount. */
-      struct pb_buffer *b = NULL;
-      pb_reference(&b, &bo->base);
+      p_atomic_inc(&bo->base.reference.count);
       goto done;
    }