Module: Mesa Branch: main Commit: de34c2c29b03a2ea8e1b266736dd9b5cf1b1ce00 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=de34c2c29b03a2ea8e1b266736dd9b5cf1b1ce00
Author: Rob Clark <[email protected]> Date: Fri Oct 14 11:32:01 2022 -0700 freedreno: Fix fence unref race Destroying a fence that was never flushed could race with the submit queue, which could cause either an fd leak or closing an fd that the retire queue would want to use. Signed-off-by: Rob Clark <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/19080> --- src/gallium/drivers/freedreno/freedreno_fence.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/gallium/drivers/freedreno/freedreno_fence.c b/src/gallium/drivers/freedreno/freedreno_fence.c index 324f3abc1ad..35380518c81 100644 --- a/src/gallium/drivers/freedreno/freedreno_fence.c +++ b/src/gallium/drivers/freedreno/freedreno_fence.c @@ -104,19 +104,18 @@ fd_fence_destroy(struct pipe_fence_handle *fence) fd_fence_ref(&fence->last_fence, NULL); tc_unflushed_batch_token_reference(&fence->tc_token, NULL); + + /* If the submit is enqueued to the submit_queue, we need to wait until + * the fence_fd is valid before cleaning up. + */ + util_queue_fence_wait(&fence->submit_fence.ready); + if (fence->submit_fence.use_fence_fd) close(fence->submit_fence.fence_fd); if (fence->syncobj) drmSyncobjDestroy(fd_device_fd(fence->screen->dev), fence->syncobj); fd_pipe_del(fence->pipe); - /* TODO might be worth trying harder to avoid a potential stall here, - * but that would require the submit somehow holding a reference to - * the pipe_fence_handle.. and I'm not sure if it is a thing that is - * likely to matter much. - */ - util_queue_fence_wait(&fence->submit_fence.ready); - FREE(fence); }
