Attachment 95205 Details for Bug 75279 – patch to fix fence wait on screen destroy

[patch] patch to fix fence wait on screen destroy

0001-nouveau-fix-fence-waiting-logic-in-screen-destroy.patch (text/plain), 3.63 KB, created by Ilia Mirkin on 2014-03-06 03:30:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ilia Mirkin

Created: 2014-03-06 03:30:20 UTC

Size: 3.63 KB

patch

obsolete

>From 27476f7774e0f99453fcae0c7959f2ca87e47d37 Mon Sep 17 00:00:00 2001
>From: Ilia Mirkin <imirkin@alum.mit.edu>
>Date: Wed, 5 Mar 2014 22:25:55 -0500
>Subject: [PATCH] nouveau: fix fence waiting logic in screen destroy
>
>nouveau_fence_wait has the expectation that an external entity is
>holding onto the fence being waited on, not that it is merely held onto
>by the current pointer. Fixes a use-after-free in nouveau_fence_wait
>when used on the screen's current fence.
>
>Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75279
>Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
>---
> src/gallium/drivers/nouveau/nv30/nv30_screen.c | 14 ++++++++++----
> src/gallium/drivers/nouveau/nv50/nv50_screen.c | 11 +++++++++--
> src/gallium/drivers/nouveau/nvc0/nvc0_screen.c |  9 ++++++++-
> 3 files changed, 27 insertions(+), 7 deletions(-)
>
>diff --git a/src/gallium/drivers/nouveau/nv30/nv30_screen.c b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
>index 82f2c06..5378913 100644
>--- a/src/gallium/drivers/nouveau/nv30/nv30_screen.c
>+++ b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
>@@ -308,10 +308,16 @@ nv30_screen_destroy(struct pipe_screen *pscreen)
>    if (!nouveau_drm_screen_unref(&screen->base))
>       return;
> 
>-   if (screen->base.fence.current &&
>-       screen->base.fence.current->state >= NOUVEAU_FENCE_STATE_EMITTED) {
>-      nouveau_fence_wait(screen->base.fence.current);
>-      nouveau_fence_ref (NULL, &screen->base.fence.current);
>+   if (screen->base.fence.current) {
>+      struct nouveau_fence *current = NULL;
>+
>+      /* nouveau_fence_wait will create a new current fence, so wait on the
>+       * _current_ one, and remove both.
>+       */
>+      nouveau_fence_ref(screen->base.fence.current, &current);
>+      nouveau_fence_wait(current);
>+      nouveau_fence_ref(NULL, &current);
>+      nouveau_fence_ref(NULL, &screen->base.fence.current);
>    }
> 
>    nouveau_object_del(&screen->query);
>diff --git a/src/gallium/drivers/nouveau/nv50/nv50_screen.c b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
>index ab0d63e..e8c7fe3 100644
>--- a/src/gallium/drivers/nouveau/nv50/nv50_screen.c
>+++ b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
>@@ -294,8 +294,15 @@ nv50_screen_destroy(struct pipe_screen *pscreen)
>       return;
> 
>    if (screen->base.fence.current) {
>-      nouveau_fence_wait(screen->base.fence.current);
>-      nouveau_fence_ref (NULL, &screen->base.fence.current);
>+      struct nouveau_fence *current = NULL;
>+
>+      /* nouveau_fence_wait will create a new current fence, so wait on the
>+       * _current_ one, and remove both.
>+       */
>+      nouveau_fence_ref(screen->base.fence.current, &current);
>+      nouveau_fence_wait(current);
>+      nouveau_fence_ref(NULL, &current);
>+      nouveau_fence_ref(NULL, &screen->base.fence.current);
>    }
>    if (screen->base.pushbuf)
>       screen->base.pushbuf->user_priv = NULL;
>diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
>index 044847d..04f3088 100644
>--- a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
>+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
>@@ -340,7 +340,14 @@ nvc0_screen_destroy(struct pipe_screen *pscreen)
>       return;
> 
>    if (screen->base.fence.current) {
>-      nouveau_fence_wait(screen->base.fence.current);
>+      struct nouveau_fence *current = NULL;
>+
>+      /* nouveau_fence_wait will create a new current fence, so wait on the
>+       * _current_ one, and remove both.
>+       */
>+      nouveau_fence_ref(screen->base.fence.current, &current);
>+      nouveau_fence_wait(current);
>+      nouveau_fence_ref(NULL, &current);
>       nouveau_fence_ref(NULL, &screen->base.fence.current);
>    }
>    if (screen->base.pushbuf)
>-- 
>1.8.3.2
>

Actions: View | Splinter Review

Attachments on bug 75279: 94465 | 94479 | 94625 | 95188 | 95189 | 95205

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.