[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 1567 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

            Bug ID: 97894
           Summary: Crash in u_transfer_unmap_vtbl when unmapping a buffer
                    mapped in different context
           Product: Mesa
           Version: git
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Drivers/Gallium/radeonsi
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: jlegg@feralinteractive.com
        QA Contact: dri-devel@lists.freedesktop.org

Created attachment 126724
  --> https://bugs.freedesktop.org/attachment.cgi?id=126724&action=edit
Apitrace reproducing issue

The following sequence of events cause a crash on radeonsi:
1. Create two contexts in the same share group
2. In one of the contexts, create and map a buffer. Then delete that context.
3. Create another context in the share group
4. Cause the buffer to be unmapped in the new context (either explicitly with
glUnmapBuffer/glUnmapNamedBuffer or implicitly via glDeleteBuffers).

The attached apitrace reproduces the issue when using an AMD R9 270, unless
environment variable LIBGL_ALWAYS_SOFTWARE is set to 1.

I reproduced this using Mesa git 36f0f0318275f65f8744ec6f9471702e2f58e6d5 and
the 12.0.3 release on x86_64 Fedora 24.
My OpenGL renderer string is Gallium 0.4 on AMD PITCAIRN (DRM 2.45.0 /
4.7.2-201.fc24.x86_64, LLVM 3.9.0).

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 3097 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 401 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

--- Comment #1 from James Legg <jlegg@feralinteractive.com> ---
Created attachment 126725
  --> https://bugs.freedesktop.org/attachment.cgi?id=126725&action=edit
Valgrind output when replaying trace

Valgrind reports a use after free error when the unmap occurs.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1417 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 303 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

--- Comment #2 from Nicolai Hähnle <nhaehnle@gmail.com> ---
You like to live dangerously :)

I can reproduce and will look into this, thank you for the clean report!

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1152 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 268 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

--- Comment #3 from Nicolai Hähnle <nhaehnle@gmail.com> ---
A candidate fix is here: https://patchwork.freedesktop.org/series/12982/

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1179 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 247 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

--- Comment #4 from James Legg <jlegg@feralinteractive.com> ---
A can confirm that patch series fixes the issue.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1099 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 97894] Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 567 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=97894

Nicolai Hähnle <nhaehnle@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Nicolai Hähnle <nhaehnle@gmail.com> ---
Fixed in Mesa master (commit e56e1f8119f28eebbe6fbe7040c80a6dd884f5fd).

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2166 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel