Module: Mesa Branch: main Commit: 7a0033a1c9c2c0bdf291fa44fb608357bf2f88dc URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=7a0033a1c9c2c0bdf291fa44fb608357bf2f88dc
Author: Boris Brezillon <[email protected]> Date: Fri Jun 23 09:18:31 2023 +0200 winsys/panfrost: Make sure we reset scanout on error in create_kms_dumb_buffer_for_resource() If an error occured, make sure we reset the scanout object before leaving, otherwise the next user of this handle will hit the refcnt == 0 assert. Fixes: ad4d7ca83324 ("kmsro: Fix renderonly_scanout BO aliasing") Cc: mesa-stable Signed-off-by: Boris Brezillon <[email protected]> Reviewed-by: Italo Nicola <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23746> --- src/gallium/winsys/panfrost/drm/panfrost_drm_winsys.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/gallium/winsys/panfrost/drm/panfrost_drm_winsys.c b/src/gallium/winsys/panfrost/drm/panfrost_drm_winsys.c index 2710217a5b4..6123e32dcbd 100644 --- a/src/gallium/winsys/panfrost/drm/panfrost_drm_winsys.c +++ b/src/gallium/winsys/panfrost/drm/panfrost_drm_winsys.c @@ -45,6 +45,7 @@ panfrost_create_kms_dumb_buffer_for_resource(struct pipe_resource *rsc, { /* Find the smallest width alignment that gives us a 64byte aligned stride */ unsigned blk_sz = util_format_get_blocksize(rsc->format); + struct renderonly_scanout *scanout = NULL; assert(blk_sz); @@ -74,8 +75,6 @@ panfrost_create_kms_dumb_buffer_for_resource(struct pipe_resource *rsc, if (create_dumb.pitch % 64) goto free_dumb; - struct renderonly_scanout *scanout; - simple_mtx_lock(&ro->bo_map_lock); scanout = util_sparse_array_get(&ro->bo_map, create_dumb.handle); simple_mtx_unlock(&ro->bo_map_lock); @@ -107,6 +106,12 @@ panfrost_create_kms_dumb_buffer_for_resource(struct pipe_resource *rsc, return scanout; free_dumb: + /* If an error occured, make sure we reset the scanout object before + * leaving. + */ + if (scanout) + memset(scanout, 0, sizeof(*scanout)); + destroy_dumb.handle = create_dumb.handle; drmIoctl(ro->kms_fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy_dumb);
