From ccd3bb45483b25330f435d7e041a69237edc9631 Mon Sep 17 00:00:00 2001 From: Chia-I Wu Date: Thu, 7 Sep 2023 10:28:31 -0700 Subject: [PATCH] winsys/radeon: fix a race between bo import and destroy This is similar to commit 85e74944c69 ("winsys/amdgpu: fix a race between import and destroy") but for winsys/radeon. In short, we need to check the reference count again after bo_handles_mutex is held. Part-of: --- src/gallium/winsys/radeon/drm/radeon_drm_bo.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c index 6ffeab7..c44811e 100644 --- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c +++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c @@ -338,6 +338,11 @@ void radeon_bo_destroy(void *winsys, struct pb_buffer *_buf) memset(&args, 0, sizeof(args)); mtx_lock(&rws->bo_handles_mutex); + /* radeon_winsys_bo_from_handle might have revived the bo */ + if (pipe_is_referenced(&bo->base.reference)) { + mtx_unlock(&rws->bo_handles_mutex); + return; + } _mesa_hash_table_remove_key(rws->bo_handles, (void*)(uintptr_t)bo->handle); if (bo->flink_name) { _mesa_hash_table_remove_key(rws->bo_names, @@ -1191,8 +1196,7 @@ static struct pb_buffer *radeon_winsys_bo_from_handle(struct radeon_winsys *rws, if (bo) { /* Increase the refcount. */ - struct pb_buffer *b = NULL; - pb_reference(&b, &bo->base); + p_atomic_inc(&bo->base.reference.count); goto done; } -- 2.7.4