Skip to content

crocus: fix race condition related to cache

Patrick Lerda requested to merge noblock/mesa:crocusfixracecondition into main

Indeed, "ice->shaders.cache" is processed concurrently by at least two threads. A mutex is required.

For instance, with "piglit/bin/tex-miplevel-selection texture(bias) 2DArray -auto -fbo":

==14393==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000000c08 at pc 0x7f4486728891 bp 0x7f4479910390 sp 0x7f4479910388
READ of size 8
at 0x60f000000c08 thread T2
    #0 0x7f4486728890 in crocus_find_cached_shader ../src/gallium/drivers/crocus/crocus_program_cache.c:95
    #1 0x7f44867296d2 in crocus_blorp_lookup_shader ../src/gallium/drivers/crocus/crocus_program_cache.c:246
    #2 0x7f4486338c62 in blorp_params_get_clear_kernel_fs ../src/intel/blorp/blorp_clear.c:67
    #3 0x7f448633c77b in blorp_params_get_clear_kernel ../src/intel/blorp/blorp_clear.c:199
    #4 0x7f448633c77b in blorp_clear ../src/intel/blorp/blorp_clear.c:631
    #5 0x7f448674fa1d in clear_color ../src/gallium/drivers/crocus/crocus_clear.c:380
    #6 0x7f44867543b5 in crocus_clear ../src/gallium/drivers/crocus/crocus_clear.c:694
    #7 0x7f448347afbc in tc_call_clear ../src/gallium/auxiliary/util/u_threaded_context.c:4356
    #8 0x7f448347e443 in batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:321
    #9 0x7f448347e443 in tc_batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:365
    #10 0x7f4481c50838 in util_queue_thread_func ../src/util/u_queue.c:309
    #11 0x7f4481d93c3a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #12 0x7f448d1be02b in start_thread glibc-2.36/nptl/pthread_create.c:442
    #13 0x7f448d23e46b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x60f000000c08 is located 136 bytes inside of 176-byte region [0x60f000000b80,0x60f000000c30)
freed by thread T0 here:
    #0 0x7f448eb9e4d7 in free (/usr/lib64/libasan.so.6+0xb14d7)
    #1 0x7f4481c3e0b8 in _mesa_hash_table_rehash ../src/util/hash_table.c:427
    #2 0x7f4481c3ee99 in hash_table_insert ../src/util/hash_table.c:439
    #3 0x7f4486729309 in crocus_upload_shader ../src/gallium/drivers/crocus/crocus_program_cache.c:233
    #4 0x7f44866d97f3 in crocus_disk_cache_retrieve ../src/gallium/drivers/crocus/crocus_disk_cache.c:217
    #5 0x7f4486719414 in crocus_create_vs_state ../src/gallium/drivers/crocus/crocus_program.c:2776
    #6 0x7f4481f45e44 in st_create_nir_shader ../src/mesa/state_tracker/st_program.c:537
    #7 0x7f4481f47982 in st_create_common_variant ../src/mesa/state_tracker/st_program.c:756
    #8 0x7f4481f51639 in st_get_common_variant ../src/mesa/state_tracker/st_program.c:809
    #9 0x7f4481f52ca6 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1275
    #10 0x7f4481f52ca6 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1352
    #11 0x7f4481f537c7 in st_program_string_notify ../src/mesa/state_tracker/st_program.c:1391
    #12 0x7f4482605a8b in _mesa_get_fixed_func_vertex_program ../src/mesa/main/ffvertex_prog.c:1779
    #13 0x7f4481de3d6e in update_program ../src/mesa/main/state.c:283
    #14 0x7f4481de599f in _mesa_update_state_locked ../src/mesa/main/state.c:562
    #15 0x7f4481de5f09 in _mesa_update_state ../src/mesa/main/state.c:595
    #16 0x7f4481f6e827 in _mesa_Begin ../src/mesa/vbo/vbo_exec_api.c:835

Fixes: f3630548 ("crocus: initial gallium driver for Intel gfx 4-7")

Signed-off-by: Patrick Lerda patrick9876@free.fr

Merge request reports