https://bugs.freedesktop.org/show_bug.cgi?id=97894
Bug ID: 97894 Summary: Crash in u_transfer_unmap_vtbl when unmapping a buffer mapped in different context Product: Mesa Version: git Hardware: x86-64 (AMD64) OS: Linux (All) Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/radeonsi Assignee: dri-devel@lists.freedesktop.org Reporter: jlegg@feralinteractive.com QA Contact: dri-devel@lists.freedesktop.org
Created attachment 126724 --> https://bugs.freedesktop.org/attachment.cgi?id=126724&action=edit Apitrace reproducing issue
The following sequence of events cause a crash on radeonsi: 1. Create two contexts in the same share group 2. In one of the contexts, create and map a buffer. Then delete that context. 3. Create another context in the share group 4. Cause the buffer to be unmapped in the new context (either explicitly with glUnmapBuffer/glUnmapNamedBuffer or implicitly via glDeleteBuffers).
The attached apitrace reproduces the issue when using an AMD R9 270, unless environment variable LIBGL_ALWAYS_SOFTWARE is set to 1.
I reproduced this using Mesa git 36f0f0318275f65f8744ec6f9471702e2f58e6d5 and the 12.0.3 release on x86_64 Fedora 24. My OpenGL renderer string is Gallium 0.4 on AMD PITCAIRN (DRM 2.45.0 / 4.7.2-201.fc24.x86_64, LLVM 3.9.0).
https://bugs.freedesktop.org/show_bug.cgi?id=97894
--- Comment #1 from James Legg jlegg@feralinteractive.com --- Created attachment 126725 --> https://bugs.freedesktop.org/attachment.cgi?id=126725&action=edit Valgrind output when replaying trace
Valgrind reports a use after free error when the unmap occurs.
https://bugs.freedesktop.org/show_bug.cgi?id=97894
--- Comment #2 from Nicolai Hähnle nhaehnle@gmail.com --- You like to live dangerously :)
I can reproduce and will look into this, thank you for the clean report!
https://bugs.freedesktop.org/show_bug.cgi?id=97894
--- Comment #3 from Nicolai Hähnle nhaehnle@gmail.com --- A candidate fix is here: https://patchwork.freedesktop.org/series/12982/
https://bugs.freedesktop.org/show_bug.cgi?id=97894
--- Comment #4 from James Legg jlegg@feralinteractive.com --- A can confirm that patch series fixes the issue.
https://bugs.freedesktop.org/show_bug.cgi?id=97894
Nicolai Hähnle nhaehnle@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED
--- Comment #5 from Nicolai Hähnle nhaehnle@gmail.com --- Fixed in Mesa master (commit e56e1f8119f28eebbe6fbe7040c80a6dd884f5fd).
dri-devel@lists.freedesktop.org