From b687f766fddb7b39479cd9ee0427984029ea3559 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Marek=20Ol=C5=A1=C3=A1k?= <marek.olsak@amd.com>
Date: Tue, 25 Oct 2016 13:10:49 +0200
Subject: [PATCH] st/mesa: allow multiple concurrent waiters in ClientWaitSync
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

so->fence can be unreferenced by one thread while another thread is
somewhere in ClientWaitSync and expecting so->fence to be non-NULL.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98172

Cc: 12.0 13.0 <mesa-stable@lists.freedesktop.org>
Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
---
 src/mesa/state_tracker/st_cb_syncobj.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/src/mesa/state_tracker/st_cb_syncobj.c b/src/mesa/state_tracker/st_cb_syncobj.c
index 749c124..7a4ba71 100644
--- a/src/mesa/state_tracker/st_cb_syncobj.c
+++ b/src/mesa/state_tracker/st_cb_syncobj.c
@@ -41,16 +41,21 @@ struct st_sync_object {
    struct gl_sync_object b;
 
    struct pipe_fence_handle *fence;
+   mtx_t mutex; /**< protects "fence" */
 };
 
 
 static struct gl_sync_object * st_new_sync_object(struct gl_context *ctx,
                                                   GLenum type)
 {
-   if (type == GL_SYNC_FENCE)
-      return (struct gl_sync_object*)CALLOC_STRUCT(st_sync_object);
-   else
+   if (type == GL_SYNC_FENCE) {
+      struct st_sync_object *so = CALLOC_STRUCT(st_sync_object);
+
+      mtx_init(&so->mutex, mtx_plain);
+      return &so->b;
+   } else {
       return NULL;
+   }
 }
 
 static void st_delete_sync_object(struct gl_context *ctx,
@@ -60,6 +65,7 @@ static void st_delete_sync_object(struct gl_context *ctx,
    struct st_sync_object *so = (struct st_sync_object*)obj;
 
    screen->fence_reference(screen, &so->fence, NULL);
+   mtx_destroy(&so->mutex);
    free(so->b.Label);
    free(so);
 }
@@ -83,13 +89,22 @@ static void st_client_wait_sync(struct gl_context *ctx,
    struct pipe_context *pipe = st_context(ctx)->pipe;
    struct pipe_screen *screen = pipe->screen;
    struct st_sync_object *so = (struct st_sync_object*)obj;
+   struct pipe_fence_handle *fence = NULL;
 
    /* If the fence doesn't exist, assume it's signalled. */
+   mtx_lock(&so->mutex);
    if (!so->fence) {
+      mtx_unlock(&so->mutex);
       so->b.StatusFlag = GL_TRUE;
       return;
    }
 
+   /* We need a local copy of the fence pointer, so that we can call
+    * fence_finish unlocked.
+    */
+   screen->fence_reference(screen, &fence, so->fence);
+   mtx_unlock(&so->mutex);
+
    /* Section 4.1.2 of OpenGL 4.5 (Compatibility Profile) says:
     *    [...] if ClientWaitSync is called and all of the following are true:
     *    - the SYNC_FLUSH_COMMANDS_BIT bit is set in flags,
@@ -102,10 +117,13 @@ static void st_client_wait_sync(struct gl_context *ctx,
     * Assume GL_SYNC_FLUSH_COMMANDS_BIT is always set, because applications
     * forget to set it.
     */
-   if (screen->fence_finish(screen, pipe, so->fence, timeout)) {
+   if (screen->fence_finish(screen, pipe, fence, timeout)) {
+      mtx_lock(&so->mutex);
       screen->fence_reference(screen, &so->fence, NULL);
+      mtx_unlock(&so->mutex);
       so->b.StatusFlag = GL_TRUE;
    }
+   screen->fence_reference(screen, &fence, NULL);
 }
 
 static void st_check_sync(struct gl_context *ctx, struct gl_sync_object *obj)
-- 
2.7.4