Mesa (staging/22.1): lima,panfrost: Do not ralloc contexts against the screen

[GitLab Mirror]

Module: Mesa
Branch: staging/22.1
Commit: 93561a98b174901ce8d7483e02b7f6a6537b1e92
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=93561a98b174901ce8d7483e02b7f6a6537b1e92

Author: Alyssa Rosenzweig <alyssa at collabora.com>
Date:   Fri Jun 24 10:42:00 2022 -0400

lima,panfrost: Do not ralloc contexts against the screen

ralloc is not thread-safe. While a given context can only be accessed from a
single thread at once, multiple contexts can be created against the same screen
at once. The ralloc allocations against the shared screens will race. Depending
on the result of the race, the same block of memory can be returned as the two
new contexts in two different threads, causing a use-after-free when the context
is freed later.

We free the context explicitly when it's destroyed anyway. If screens are
getting destroyed without the contexts getting destroyed first, that's a state
tracker bug, not a Panfrost one.

This matches what Iris does.

Fixes crash in test_integer_ops.int_math on Panfrost.

Fixes: 0fcf73bc2d4 ("panfrost: Move to use ralloc for some allocations")
Signed-off-by: Alyssa Rosenzweig <alyssa at collabora.com>
Reviewed-by: Jesse Natalie <jenatali at microsoft.com>
Reviewed-by: Vasily Khoruzhick <anarsoul at gmail.com>
Reviewed-by: Jason Ekstrand <jason.ekstrand at collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/17234>
(cherry picked from commit f18492faa9f692d62cee774066ef182d3e279eec)

---

 .pick_status.json                          | 2 +-
 src/gallium/drivers/lima/lima_context.c    | 2 +-
 src/gallium/drivers/panfrost/pan_context.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index aad5e12ad08..df082b234a8 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -688,7 +688,7 @@
         "description": "lima,panfrost: Do not ralloc contexts against the screen",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "0fcf73bc2d4dc292895ef8930f4f445d933b1630"
     },
diff --git a/src/gallium/drivers/lima/lima_context.c b/src/gallium/drivers/lima/lima_context.c
index f9d423a31fb..1070a56d25c 100644
--- a/src/gallium/drivers/lima/lima_context.c
+++ b/src/gallium/drivers/lima/lima_context.c
@@ -205,7 +205,7 @@ lima_context_create(struct pipe_screen *pscreen, void *priv, unsigned flags)
    struct lima_screen *screen = lima_screen(pscreen);
    struct lima_context *ctx;
 
-   ctx = rzalloc(screen, struct lima_context);
+   ctx = rzalloc(NULL, struct lima_context);
    if (!ctx)
       return NULL;
 
diff --git a/src/gallium/drivers/panfrost/pan_context.c b/src/gallium/drivers/panfrost/pan_context.c
index 7d3c050306b..46b2c890c84 100644
--- a/src/gallium/drivers/panfrost/pan_context.c
+++ b/src/gallium/drivers/panfrost/pan_context.c
@@ -1048,7 +1048,7 @@ panfrost_set_stream_output_targets(struct pipe_context *pctx,
 struct pipe_context *
 panfrost_create_context(struct pipe_screen *screen, void *priv, unsigned flags)
 {
-        struct panfrost_context *ctx = rzalloc(screen, struct panfrost_context);
+        struct panfrost_context *ctx = rzalloc(NULL, struct panfrost_context);
         struct pipe_context *gallium = (struct pipe_context *) ctx;
         struct panfrost_device *dev = pan_device(screen);