Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NV12 support in libgbm #4

Open
jmondi opened this issue Dec 12, 2022 · 2 comments
Open

NV12 support in libgbm #4

jmondi opened this issue Dec 12, 2022 · 2 comments

Comments

@jmondi
Copy link

jmondi commented Dec 12, 2022

Hello, opening an issue here to continue the discussion from
waydroid/android_hardware_waydroid#44

Let me recap the context:

I'm working on enabling camera support for Waydroid on a PinephonePro which use an RK3399 SoC.
The RK3399 camera subsystem produces images in NV12 format (only partially supports other formats, NV12 is strongly preferred).

As per Android design, the Camera HAL and the gralloc HAL implementation should agree on what format HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED has to be mapped to (see the above mentioned merge request).

The gralloc_gbm backend does the allocation using libgbm, which is provided by mesa on Waydroid and which as of today doesn't support NV12.

I investigated with upstream #dri-devel last week about this, and what I've been told is that NV12 support is not in upstream mesa because nobody actually used that, and I've been reminded that the 'g' in 'gbm' stands for 'graphic' and not 'generic' so it is probably possible to add NV12 support to mesa, but it's not that anyone really cares as RGB formats are way more common.

So here's my question(s)

  1. Is NV12/YCbCr use case supported by Waydroid ? I see this line in the gralloc implementation
    https://github.com/waydroid/android_hardware_waydroid/blob/lineage-18.1/gralloc/gralloc_gbm.cpp#L100
    which makes me think support for some kind of YUV format was needed and it has been implemented by mapping it on what's available on mesa today, with a few hacks here and there to have it working
    https://github.com/waydroid/android_hardware_waydroid/blob/lineage-18.1/gralloc/gralloc_gbm.cpp#L194

This commit actually puzzles me as well waydroid/android_hardware_waydroid@0876013
as I don't see any "mapping" there, as a value of "0" doesn't seem a valid GBM_FORMAT value.

  1. ChromiumOS, which has several supported devices on RK3399, has adopted minigbm (which waydroid ships) as their gralloc_gbm backend implementation, which (afaiu) supports allocating NV12 buffers on the Rockchip using a driver-custom ioctl()
    https://github.com/waydroid/android_external_minigbm/blob/lineage-18.1/rockchip.c#L173
    Yes, it requires out-of-tree kernel support at the moment. The reasons why that ioctl is not in the rockchip upstream DRM driver are not fully clear to me yet.

In a case like this, where using minigbm seems more appropriate for the device at hand, would it be possible to instrument the Waydroid build to pick minigbm instead of mesa as libgbm provider ?

All in all, with the current gralloc+mesa implementation, camera support using NV12 format doesn't seem possible to me...

@rmader
Copy link
Contributor

rmader commented Feb 7, 2023

@fooishbar this is the issue regarding Waydroid and NV12 in Mesa we shortly talked about at FOSDEM - you said you might have something in mind?

@fooishbar
Copy link
Contributor

@rmader thanks for the tag!

@jmondi you're right that it is indeed the Graphics Buffer Manager, not Generic. You can often use GBM as a proxy for gralloc, but not always. In particular, Mesa doesn't implement NV12 as a BO/surface type for alloc, because we don't (currently) have support for NV12 as a GPU render target. NV12 imports may work directly, or you may need to separately import each plane as R8/GR88 and do the CSC yourself.

I guess the three paths I can see are:

  • just take the downstream kernel patches to add the Rockchip alloc ioctls, and use minigbm - least effort, worst result
  • adapt the minigbm patches to use dma-heaps instead and use this - medium effort and still requires minigbm but does at least remove the dependency on downstream kernel uAPI
  • allocate camera buffers via the camera rather than via gralloc - probably highest effort and highest divergence from Android but does at least match upstream

aleasto pushed a commit that referenced this issue Apr 20, 2023
For instance, with "piglit/bin/arb_shader_image_load_store-host-mem-barrier --quick -auto -fbo":
==18549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000a059 at pc 0x7f65d8937b80 bp 0x7fff6ed19a00 sp 0x7fff6ed199f8
READ of size 1 at 0x61200000a059 thread T0
    #0 0x7f65d8937b7f in evergreen_set_shader_images ../src/gallium/drivers/r600/evergreen_state.c:4277
    #1 0x7f65d6b471b8 in st_bind_images ../src/mesa/state_tracker/st_atom_image.c:172
    #2 0x7f65d6b76b26 in st_validate_state ../src/mesa/state_tracker/st_util.h:129
    #3 0x7f65d6b76b26 in prepare_draw ../src/mesa/state_tracker/st_draw.c:88
    #4 0x7f65d6b77c8a in st_draw_gallium ../src/mesa/state_tracker/st_draw.c:141
    #5 0x7f65d72698a2 in _mesa_draw_arrays ../src/mesa/main/draw.c:1202

Fixes: a6b3792 ("r600: add core pieces of image support.")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Gert Wollny <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22273>
(cherry picked from commit e0ed2b2)
atmouse- pushed a commit to atmouse-/android_external_mesa3d that referenced this issue May 26, 2023
This change is inspired from iris_destroy_context().

For instance, this issue is triggered with
"piglit/bin/glsl-1.50-gs-max-output -scan 1 20 -auto -fbo":
Direct leak of 320 byte(s) in 2 object(s) allocated from:
    #0 0x7f34fc769987 in calloc (/usr/lib64/libasan.so.6+0xb1987)
    waydroid#1 0x7f34f4fa168a in bo_calloc ../src/gallium/drivers/crocus/crocus_bufmgr.c:288
    waydroid#2 0x7f34f4fa168a in alloc_fresh_bo ../src/gallium/drivers/crocus/crocus_bufmgr.c:350
    waydroid#3 0x7f34f4fa168a in bo_alloc_internal ../src/gallium/drivers/crocus/crocus_bufmgr.c:419
    waydroid#4 0x7f34f4fe50a9 in crocus_get_scratch_space ../src/gallium/drivers/crocus/crocus_program.c:2678
    waydroid#5 0x7f34f55e8954 in crocus_upload_dirty_render_state ../src/gallium/drivers/crocus/crocus_state.c:6871
    waydroid#6 0x7f34f55e8954 in crocus_upload_render_state ../src/gallium/drivers/crocus/crocus_state.c:7812
    waydroid#7 0x7f34f5d9f680 in crocus_simple_draw_vbo ../src/gallium/drivers/crocus/crocus_draw.c:332
    waydroid#8 0x7f34f5d9f680 in crocus_draw_vbo ../src/gallium/drivers/crocus/crocus_draw.c:438
    waydroid#9 0x7f34f1d2eeba in tc_call_draw_single ../src/gallium/auxiliary/util/u_threaded_context.c:3735
    waydroid#10 0x7f34f1d12e03 in batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:394
    waydroid#11 0x7f34f1d12e03 in tc_batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:445
    #12 0x7f34f1d22c9a in _tc_sync ../src/gallium/auxiliary/util/u_threaded_context.c:680
    #13 0x7f34f1d238f8 in tc_texture_map ../src/gallium/auxiliary/util/u_threaded_context.c:2754
    #14 0x7f34f120b9d9 in pipe_texture_map_3d ../src/gallium/auxiliary/util/u_inlines.h:579
    #15 0x7f34f120b9d9 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:530
    #16 0x7f34f10d7355 in read_pixels ../src/mesa/main/readpix.c:1178
    #17 0x7f34f10d7355 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1195
    #18 0x7f34f10d7e10 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1210

Fixes: f363054 ("f3630548f1da crocus: initial gallium driver for Intel gfx 4-7")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Filip Gawin <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23019>
(cherry picked from commit 6ee0bba)
aleasto pushed a commit that referenced this issue Jun 10, 2023
For instance, this is triggered with "piglit/bin/ext_direct_state_access-named-program -auto -fbo":
==5695==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000050031 at pc 0x7f78dfca8d46 bp 0x7ffd9043b4a0 sp 0x7ffd9043ac50
READ of size 50 at 0x606000050031 thread T0
    #0 0x7f78dfca8d45  (/usr/lib64/libasan.so.6+0x3fd45)
    #1 0x7f78d450b18f in set_program_string ../src/mesa/main/arbprogram.c:385
    #2 0x7f78d3fdbd3e in execute_list ../src/mesa/main/dlist.c:13025
    #3 0x7f78d40c2564 in _mesa_CallList ../src/mesa/main/dlist.c:13451
    #4 0x7f78d42f380a in _mesa_unmarshal_CallList ../src/mesa/main/glthread_list.c:43
    #5 0x7f78d38e85c5 in glthread_unmarshal_batch ../src/mesa/main/glthread.c:122
    #6 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:382
    #7 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:347
    #8 0x7f78d3d73f69 in _mesa_marshal_IsProgramARB src/mapi/glapi/gen/marshal_generated2.c:4256

Fixes: 0b196b4 ("mesa: don't compute the same SHA1 twice in glShaderSource")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23295>
(cherry picked from commit 44b960a)
aleasto pushed a commit that referenced this issue Jun 10, 2023
The previous implementation was copying the data using the
aligned length (size_dw). The aligned length could overflow
the original buffer size.

For instance, this issue is triggered with "piglit/bin/draw-batch -auto -fbo":
==5736==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff139c77e8 at pc 0x7f25b350a9a0 bp 0x7fff139c6cb0 sp 0x7fff139c6460
READ of size 8 at 0x7fff139c77e8 thread T0
    #0 0x7f25b350a99f in __interceptor_memcpy (/usr/lib64/libasan.so.6+0x3c99f)
    #1 0x7f25a8fcdf24 in radeon_emit_array ../src/gallium/include/winsys/radeon_winsys.h:760
    #2 0x7f25a8fcdf24 in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2448
    #3 0x7f25a8ae7ba1 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1791
    #4 0x7f25a7bc18ca in _mesa_validated_drawrangeelements ../src/mesa/main/draw.c:1696
    #5 0x7f25a7bc7e53 in _mesa_DrawElements ../src/mesa/main/draw.c:1824

Fixes: 0cf5d1f ("gallium: remove PIPE_CAP_INFO_START_WITH_USER_INDICES and fix all drivers")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23436>
(cherry picked from commit 340311d)
aleasto pushed a commit that referenced this issue Jun 23, 2023
Indeed, this function was not processing the linked
allocated list.

For instance, this issue is triggered with "piglit/bin/hiz-depth-read-fbo-d24-s0 -auto":
Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f6795638987 in calloc (/usr/lib64/libasan.so.6+0xb1987)
    #1 0x7f678bac13b9 in nouveau_heap_alloc ../src/gallium/drivers/nouveau/nouveau_heap.c:64
    #2 0x7f678bb6c7e4 in nv50_program_upload_code ../src/gallium/drivers/nouveau/nv50/nv50_program.c:490
    #3 0x7f678bb83b92 in nv50_vertprog_validate ../src/gallium/drivers/nouveau/nv50/nv50_shader_state.c:161
    #4 0x7f678bba3000 in nv50_state_validate ../src/gallium/drivers/nouveau/nv50/nv50_state_validate.c:552
    #5 0x7f678bba3c4d in nv50_state_validate_3d ../src/gallium/drivers/nouveau/nv50/nv50_state_validate.c:575
    #6 0x7f678b9e3e92 in nv50_blit_3d ../src/gallium/drivers/nouveau/nv50/nv50_surface.c:1444
    #7 0x7f678b9e3e92 in nv50_blit ../src/gallium/drivers/nouveau/nv50/nv50_surface.c:1832
    #8 0x7f678a0b378a in blit_to_staging ../src/mesa/state_tracker/st_cb_readpixels.c:337
    #9 0x7f678a0b7358 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:516
    #10 0x7f6789f82005 in read_pixels ../src/mesa/main/readpix.c:1178
    #11 0x7f6789f82005 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1195
    #12 0x7f6789f82ac0 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1210
...
SUMMARY: AddressSanitizer: 80 byte(s) leaked in 2 allocation(s).

Fixes: 67635a0 ("nouveau: get rid of tabs")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Karol Herbst <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23592>
(cherry picked from commit 1980934)
aleasto pushed a commit that referenced this issue Jun 23, 2023
This change fixes a buffer overflow by implementing the
special swizzles. This behavior is already available with
evergreen_convert_border_color().

For instance, this issue is triggered on a cayman gpu with
"piglit/bin/texwrap bordercolor -auto -fbo" or "piglit/bin/max-samplers -auto -fbo":
==5610==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000012d20 at pc 0x7fb798cb876f bp 0x7ffd78670460 sp 0x7ffd78670458
READ of size 4 at 0x603000012d20 thread T0
    #0 0x7fb798cb876e in cayman_convert_border_color ../src/gallium/drivers/r600/evergreen_state.c:2444
    #1 0x7fb798cb876e in evergreen_emit_sampler_states ../src/gallium/drivers/r600/evergreen_state.c:2539
    #2 0x7fb7989e6cb2 in r600_emit_atom ../src/gallium/drivers/r600/r600_pipe.h:655
    #3 0x7fb7989e6cb2 in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2333
    #4 0x7fb7985082c7 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1497
    #5 0x7fb796ef2eda in cso_draw_vbo ../src/gallium/auxiliary/cso_cache/cso_context.h:262
    #6 0x7fb796ef2eda in st_draw_gallium_multimode ../src/mesa/state_tracker/st_draw.c:170
    #7 0x7fb7970d9cfd in vbo_exec_vtx_flush ../src/mesa/vbo/vbo_exec_draw.c:341
    #8 0x7fb7970d32d7 in vbo_exec_FlushVertices_internal ../src/mesa/vbo/vbo_exec_api.c:693
    #9 0x7fb7970d32d7 in vbo_exec_FlushVertices ../src/mesa/vbo/vbo_exec_api.c:1193
    #10 0x7fb7975f237c in enable_texture ../src/mesa/main/enable.c:337

Fixes: 923d635 ("r600: fix some border color swizzles on CAYMAN")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Gert Wollny <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23435>
(cherry picked from commit 4284705)
aleasto pushed a commit that referenced this issue Aug 31, 2023
    ../src/panfrost/compiler/compiler.h:89:14: runtime error: left shift of 51966 by 16 places cannot be represented in type 'int'
        #0 0x55c72fd7dda4 in bi_apply_swizzle ../src/panfrost/compiler/compiler.h:89
        #1 0x55c72fd808d6 in bi_source_value ../src/panfrost/compiler/bi_opt_constant_fold.c:35
        #2 0x55c72fd80a83 in bi_fold_constant ../src/panfrost/compiler/bi_opt_constant_fold.c:52
        #3 0x55c72fb2080c in constant_fold_pred ../src/panfrost/compiler/test/test-constant-fold.cpp:48
        #4 0x55c72fb21a65 in ConstantFold_Swizzles_Test::TestBody() ../src/panfrost/compiler/test/test-constant-fold.cpp:103
        #5 0x55c73070cc97 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../src/gtest/src/gtest.cc:2621
        #6 0x55c7306f0df7 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../src/gtest/src/gtest.cc:2657
        #7 0x55c730694add in testing::Test::Run() ../src/gtest/src/gtest.cc:2696
        #8 0x55c73069798d in testing::TestInfo::Run() ../src/gtest/src/gtest.cc:2845
        #9 0x55c73069b684 in testing::TestSuite::Run() ../src/gtest/src/gtest.cc:3004
        #10 0x55c7306ccfcb in testing::internal::UnitTestImpl::RunAllTests() ../src/gtest/src/gtest.cc:5890
        #11 0x55c73071053c in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../src/gtest/src/gtest.cc:2621
        #12 0x55c7306f4ed3 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../src/gtest/src/gtest.cc:2657
        #13 0x55c7306c23fa in testing::UnitTest::Run() ../src/gtest/src/gtest.cc:5455
        #14 0x55c730748faf in RUN_ALL_TESTS() ../src/gtest/include/gtest/gtest.h:2314
        #15 0x55c730748ffa in main ../src/gtest/src/gtest_main.cc:63
        #16 0x7f8554bcc1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        #17 0x7f8554bcc284 in __libc_start_main_impl ../csu/libc-start.c:360
        #18 0x55c72fb18be0 in _start (/builds/mesa/mesa/_build/src/panfrost/compiler/bifrost_tests+0xbd0be0)

Cc: mesa-stable
Signed-off-by: Eric Engestrom <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24610>
(cherry picked from commit 54c7099)
aleasto pushed a commit that referenced this issue Mar 7, 2024
For instance, this issue is triggered with
"piglit/bin/ext_framebuffer_multisample-accuracy all_samples color depthstencil -auto -fbo":
Direct leak of 1160 byte(s) in 1 object(s) allocated from:
    #0 0x7fbe8897d7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7fbe7e7abfcc in rc_constants_copy ../src/gallium/drivers/r300/compiler/radeon_code.c:47
    #2 0x7fbe7e7ec902 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:174
    #3 0x7fbe7e7e1b22 in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516
    #4 0x7fbe7e7e6373 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:591
    #5 0x7fbe7e75456e in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1073
    #6 0x7fbe7cd2ebe5 in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1070
    #7 0x7fbe7cd374b5 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1116
    #8 0x7fbe7cd38273 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1281
    #9 0x7fbe7cd38273 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345
    #10 0x7fbe7d798ca8 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:724
    #11 0x7fbe7d798ca8 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:952
    #12 0x7fbe7d6790d5 in link_program ../src/mesa/main/shaderapi.c:1336
    #13 0x7fbe7d6790d5 in link_program_error ../src/mesa/main/shaderapi.c:1447
...
SUMMARY: AddressSanitizer: 2528456 byte(s) leaked in 1057 allocation(s).

Fixes: 54f6e72 ("r300: better register allocator for vertex shaders")
Signed-off-by: Patrick Lerda <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27792>
(cherry picked from commit 4d00edd)
aleasto pushed a commit that referenced this issue Mar 19, 2024
For instance, this issue is triggered with
"piglit/bin/object-namespace-pollution glBitmap program -auto -fbo":
Direct leak of 112 byte(s) in 7 object(s) allocated from:
    #0 0x7f472540e7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f471a9ce18f in rc_remove_unused_constants ../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:101
    #2 0x7f471a9b0836 in rc_run_compiler_passes ../src/gallium/drivers/r300/compiler/radeon_compiler.c:476
    #3 0x7f471a9b0ad5 in rc_run_compiler ../src/gallium/drivers/r300/compiler/radeon_compiler.c:498
    #4 0x7f471a9ec862 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:172
    #5 0x7f471a9e1ab2 in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516
    #6 0x7f471a9e6303 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:591
    #7 0x7f471a9544fe in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1073
    #8 0x7f4718f2ebe5 in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1070
    #9 0x7f4718f374b5 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1116
    #10 0x7f4718f38273 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1281
    #11 0x7f4718f38273 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345
    #12 0x7f4718f389e9 in st_program_string_notify ../src/mesa/state_tracker/st_program.c:1378
    #13 0x7f47199d9f99 in set_program_string ../src/mesa/main/arbprogram.c:413

Fixes: 1c2c4dd ("r300g: copy the compiler from r300c")
Signed-off-by: Patrick Lerda <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27957>
(cherry picked from commit 29df857)
aleasto pushed a commit that referenced this issue Mar 19, 2024
Indeed, main_shader_part_ngg_es was not freed.

For instance, this issue is triggered on a radeonsi/gfx10 gpu with
"piglit/bin/arb_gpu_shader5-tf-wrong-stream-value -auto -fbo":
Direct leak of 1464 byte(s) in 1 object(s) allocated from:
    #0 0x7f17904b99a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7)
    #1 0x7f1785d65ac2 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3132
    #2 0x7f1783af67d8 in util_queue_thread_func ../src/util/u_queue.c:309
    #3 0x7f1783b51dfa in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #4 0x7f178f69d38a  (/lib64/libc.so.6+0x8438a)

Indirect leak of 2024 byte(s) in 1 object(s) allocated from:
    #0 0x7f17904b97ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f1785d5443a in read_chunk ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:221
    #2 0x7f1785d62cf5 in si_load_shader_binary ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:293
    #3 0x7f1785d65255 in si_shader_cache_load_shader ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:423
    #4 0x7f1785d65ef9 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3169
    #5 0x7f1783af67d8 in util_queue_thread_func ../src/util/u_queue.c:309
    #6 0x7f1783b51dfa in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #7 0x7f178f69d38a  (/lib64/libc.so.6+0x8438a)

Fixes: 8f72f13 ("radeonsi/gfx10: add as_ngg variant for TES as ES to select Wave32/64")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Pierre-Eric Pelloux-Prayer <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27958>
(cherry picked from commit f93f215)
aleasto pushed a commit that referenced this issue Apr 5, 2024
…rors

For instance, this issue is triggered with
"piglit/bin/glslparsertest tests/spec/arb_bindless_texture/compiler/images/arith-bound-image.frag pass 3.30 GL_ARB_bindless_texture GL_ARB_shader_image_load_store":
Direct leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbe9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7)
    #1 0x7f84ba7e0801 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4391
    #2 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759
    #3 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836
    #4 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #5 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #6 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #7 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #8 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

Direct leak of 136 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbff57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57)
    #1 0x7f84b1a5f749 in LLVMCreateBuilderInContext (/usr/local/lib64/libLLVM-17.so+0xc84749)
    #2 0x7f84ba7817b0 in ac_llvm_context_init ../src/amd/llvm/ac_llvm_build.c:54
    #3 0x7f84ba542b7a in si_llvm_context_init ../src/gallium/drivers/radeonsi/si_shader_llvm.c:120
    #4 0x7f84ba542b7a in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:832
    #5 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #6 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #7 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #8 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #9 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118
    #2 0x7f84b81b9fee in rzalloc_size ../src/util/ralloc.c:152
    #3 0x7f84b81b9fee in rzalloc_array_size ../src/util/ralloc.c:232
    #4 0x7f84b81b05c7 in _mesa_hash_table_init ../src/util/hash_table.c:163
    #5 0x7f84b81b05c7 in _mesa_hash_table_create ../src/util/hash_table.c:186
    #6 0x7f84ba7e06ae in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4381
    #7 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759
    #8 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836
    #9 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #10 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #11 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #12 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #13 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118
    #2 0x7f84b81b9fee in rzalloc_size ../src/util/ralloc.c:152
    #3 0x7f84b81b9fee in rzalloc_array_size ../src/util/ralloc.c:232
    #4 0x7f84b81b05c7 in _mesa_hash_table_init ../src/util/hash_table.c:163
    #5 0x7f84b81b05c7 in _mesa_hash_table_create ../src/util/hash_table.c:186
    #6 0x7f84ba7e06e4 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4382
    #7 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759
    #8 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836
    #9 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #10 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #11 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #12 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #13 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118
    #2 0x7f84b81b046c in _mesa_hash_table_create ../src/util/hash_table.c:182
    #3 0x7f84ba7e06e4 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4382
    #4 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759
    #5 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836
    #6 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #7 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #8 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #9 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #10 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118
    #2 0x7f84b81b046c in _mesa_hash_table_create ../src/util/hash_table.c:182
    #3 0x7f84ba7e06ae in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4381
    #4 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759
    #5 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836
    #6 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874
    #7 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176
    #8 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309
    #9 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67
    #10 0x7f84c2fea38a  (/lib64/libc.so.6+0x8438a)

SUMMARY: AddressSanitizer: 920 byte(s) leaked in 6 allocation(s).

Fixes: d92d35c ("ac/llvm: add a return value to ac_nir_translate")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28099>
(cherry picked from commit 0fd907f)
aleasto pushed a commit that referenced this issue May 8, 2024
…er path

A last memory leak related to constants_remap_table is happening.
This memory leak is triggered by two deqp-gles2 tests.

For instance, this issue is triggered with
"deqp-gles2 --deqp-case=dEQP-GLES2.functional.uniform_api.random.13":
Direct leak of 336 byte(s) in 1 object(s) allocated from:
    #0 0x7f1b4a5de7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    #1 0x7f1b401a2cdf in rc_remove_unused_constants ../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:101
    #2 0x7f1b40185386 in rc_run_compiler_passes ../src/gallium/drivers/r300/compiler/radeon_compiler.c:476
    #3 0x7f1b40185625 in rc_run_compiler ../src/gallium/drivers/r300/compiler/radeon_compiler.c:498
    #4 0x7f1b401c14d2 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:172
    #5 0x7f1b401b669a in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516
    #6 0x7f1b401baf73 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:592
    #7 0x7f1b40128db7 in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1071
    #8 0x7f1b3e67799d in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1073
    #9 0x7f1b3e680285 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1119
    #10 0x7f1b3e6812fa in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1284
    #11 0x7f1b3e6812fa in st_finalize_program ../src/mesa/state_tracker/st_program.c:1363
    #12 0x7f1b3f13d501 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:754
    #13 0x7f1b3f13d501 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:990
    #14 0x7f1b3efeef75 in link_program ../src/mesa/main/shaderapi.c:1336
    #15 0x7f1b3efeef75 in link_program_error ../src/mesa/main/shaderapi.c:1445

Fixes: 29df857 ("r300: fix constants_remap_table memory leak")
Signed-off-by: Patrick Lerda <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28522>
(cherry picked from commit 24a5165)
aleasto pushed a commit that referenced this issue May 8, 2024
Indeed, the pointer processed by r300_upload_index_buffer() was not the right one.
This is the reason why "deqp-gles2 --deqp-case=dEQP-GLES2.functional.draw.draw_elements.indices.user_ptr.index_byte"
was failing (the logs are below). This change corrects this issue and makes the related deqp tests work properly.

This change considers that r300_upload_index_buffer() sets indexBuffer to NULL. The indexBuffer resource
should be properly freed once the buffer is processed. This is required to avoid another refcnt imbalance
(another kind of memory leak).

==9962==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000721f at pc 0x7fd57b54a9a0 bp 0x7fffd2c39290 sp 0x7fffd2c38a40
READ of size 30 at 0x60200000721f thread T0
    #0 0x7fd57b54a99f in __interceptor_memcpy (/usr/lib64/libasan.so.6.0.0+0x3c99f)
    #1 0x7fd570d10528 in u_upload_data ../src/gallium/auxiliary/util/u_upload_mgr.c:333
    #2 0x7fd57114142b in r300_upload_index_buffer ../src/gallium/drivers/r300/r300_screen_buffer.c:44
    #3 0x7fd57113943c in r300_draw_elements ../src/gallium/drivers/r300/r300_render.c:632
    #4 0x7fd57113bbc4 in r300_draw_vbo ../src/gallium/drivers/r300/r300_render.c:840
    #5 0x7fd570d212e2 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1487
    #6 0x7fd56fceb873 in _mesa_validated_drawrangeelements ../src/mesa/main/draw.c:1709
    #7 0x7fd56fcf28c5 in _mesa_DrawElementsBaseVertex ../src/mesa/main/draw.c:1852

Fixes: 330d060 ("gallium: remove pipe_index_buffer and set_index_buffer")
Signed-off-by: Patrick Lerda <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28523>
(cherry picked from commit 2b6993c)
aleasto pushed a commit that referenced this issue May 8, 2024
The pointer "xfb" is allocated with a clone of "so->nir" and lost
without further processing.

The function panfrost_shader_compile() was the one processing "xfb".
The call of this function was removed with the commit 40372bd.
This makes "xfb" not required anymore.

For instance, this issue is triggered on a Mali-T820 with
"piglit/bin/arb_transform_feedback2-change-objects-while-paused -auto":
Indirect leak of 32776 byte(s) in 1 object(s) allocated from:
    #0 0xf78f30a6 in malloc (/usr/lib/libasan.so.6+0x840a6)
    #1 0xee9cd4ee in ralloc_size ../src/util/ralloc.c:118
    #2 0xee9cf7ae in create_slab ../src/util/ralloc.c:801
    #3 0xee9cf7ae in gc_alloc_size ../src/util/ralloc.c:840
    #4 0xef74ab82 in nir_undef_instr_create ../src/compiler/nir/nir.c:888
    #5 0xef76212c in clone_ssa_undef ../src/compiler/nir/nir_clone.c:328
    #6 0xef76212c in clone_instr ../src/compiler/nir/nir_clone.c:438
    #7 0xef7642d8 in clone_block ../src/compiler/nir/nir_clone.c:501
    #8 0xef7642d8 in clone_cf_list ../src/compiler/nir/nir_clone.c:555
    #9 0xef7657dc in clone_function_impl ../src/compiler/nir/nir_clone.c:632
    #10 0xef766cb8 in nir_shader_clone ../src/compiler/nir/nir_clone.c:743
    #11 0xf007673e in panfrost_create_shader_state ../src/gallium/drivers/panfrost/pan_shader.c:434
    #12 0xeeb6766c in st_create_common_variant ../src/mesa/state_tracker/st_program.c:781
    #13 0xeeb71d1c in st_get_common_variant ../src/mesa/state_tracker/st_program.c:834
    #14 0xeeb72ea2 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1320
    #15 0xeeb72ea2 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1421
    #16 0xef3806ec in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:748
    #17 0xef3806ec in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:984
    #18 0xef2992f6 in link_program ../src/mesa/main/shaderapi.c:1336
    #19 0xef2992f6 in link_program_error ../src/mesa/main/shaderapi.c:1445

Fixes: 40372bd ("panfrost: Implement a disk cache")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Boris Brezillon <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28743>
(cherry picked from commit 4f5e9a2)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Jun 25, 2024
For instance, this issue is triggered with
vs-to-fs-overlap.shader_test -auto -fbo:
Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x7fe64f58e9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7)
    waydroid#1 0x7fe642ca2839 in _mesa_symbol_table_ctor ../src/mesa/program/symbol_table.c:286
    waydroid#2 0x7fe642ff003d in gl_nir_cross_validate_outputs_to_inputs ../src/compiler/glsl/gl_nir_link_varyings.c:728
    waydroid#3 0x7fe642d7c7d8 in gl_nir_link_glsl ../src/compiler/glsl/gl_nir_linker.c:1357
    waydroid#4 0x7fe642be6931 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:562
    waydroid#5 0x7fe642be6931 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:944
    waydroid#6 0x7fe642acab55 in link_program ../src/mesa/main/shaderapi.c:1336
    waydroid#7 0x7fe642acab55 in link_program_error ../src/mesa/main/shaderapi.c:1447
    waydroid#8 0x7fe6424aa389 in _mesa_unmarshal_LinkProgram src/mapi/glapi/gen/marshal_generated2.c:1911
    waydroid#9 0x7fe641fd912b in glthread_unmarshal_batch ../src/mesa/main/glthread.c:139
    waydroid#10 0x7fe641f48d48 in util_queue_thread_func ../src/util/u_queue.c:309
    waydroid#11 0x7fe641fa442a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67

Fixes: 7d1948e ("glsl: implement cross_validate_outputs_to_inputs() in nir linker")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27071>
(cherry picked from commit bacace8)
aleasto pushed a commit that referenced this issue Jul 25, 2024
Indeed, the object returned by LLVMCreatePassBuilderOptions()
was not freed.

For instance, this issue is triggered with "piglit/bin/cl-api-build-program":
Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x7f6b15abdf57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57)
    #1 0x7f6afff6529e in LLVMCreatePassBuilderOptions llvm-18.1.5/lib/Passes/PassBuilderBindings.cpp:83
    #2 0x7f6b1186ee41 in optimize ../src/gallium/frontends/clover/llvm/invocation.cpp:521
    #3 0x7f6b1186ee41 in clover::llvm::link_program(std::vector<clover::binary, std::allocator<clover::binary> > const&, clover::device const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) ../src/gallium/frontends/clover/llvm/invocation.cpp:554
    #4 0x7f6b1150ce67 in link_program ../src/gallium/frontends/clover/core/compiler.hpp:78
    #5 0x7f6b1150ce67 in clover::program::link(clover::ref_vector<clover::device> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, clover::ref_vector<clover::program> const&) ../src/gallium/frontends/clover/core/program.cpp:78
    #6 0x7f6b11401a2b in clBuildProgram ../src/gallium/frontends/clover/api/program.cpp:283

Fixes: 2d4fe5f ("clover/llvm: move to modern pass manager.")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Karol Herbst <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29164>
(cherry picked from commit df39994)
aleasto pushed a commit that referenced this issue Jul 25, 2024
This change handles the case when "vertex_fetch_shader.cso" is null,
it implements the previous behavior in this specific case. This
situation is happening with clover.

For instance, this issue is triggered with "piglit/bin/cl-custom-buffer-flags":
==6467==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000c (pc 0x7ff92908fe6e bp 0x7ffe86ae5ad0 sp 0x7ffe86ae5a30 T0)
==6467==The signal is caused by a READ memory access.
==6467==Hint: address points to the zero page.
    #0 0x7ff92908fe6e in evergreen_emit_vertex_buffers ../src/gallium/drivers/r600/evergreen_state.c:2123
    #1 0x7ff92908444b in r600_emit_atom ../src/gallium/drivers/r600/r600_pipe.h:627
    #2 0x7ff92908444b in compute_emit_cs ../src/gallium/drivers/r600/evergreen_compute.c:798
    #3 0x7ff92908444b in evergreen_launch_grid ../src/gallium/drivers/r600/evergreen_compute.c:927
    #4 0x7ff9349f9350 in clover::kernel::launch(clover::command_queue&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::vector<unsigned long, std::allocator<unsigned long> > const&) ../src/gallium/frontends/clover/core/kernel.cpp:105
    #5 0x7ff9349c331d in std::function<void (clover::event&)>::operator()(clover::event&) const /usr/include/c++/11.4.0/bits/std_function.h:590
    #6 0x7ff9349c331d in clover::event::trigger() ../src/gallium/frontends/clover/core/event.cpp:54
    #7 0x7ff9349c82f1 in clover::hard_event::hard_event(clover::command_queue&, unsigned int, clover::ref_vector<clover::event> const&, std::function<void (clover::event&)>) ../src/gallium/frontends/clover/core/event.cpp:138
    #8 0x7ff9348daa47 in create<clover::hard_event, clover::command_queue&, int, clover::ref_vector<clover::event>&, clEnqueueNDRangeKernel(cl_command_queue, cl_kernel, cl_uint, const size_t*, const size_t*, const size_t*, cl_uint, _cl_event* const*, _cl_event**)::<lambda(clover::event&)> > ../src/gallium/frontends/clover/util/pointer.hpp:241
    #9 0x7ff9348daa47 in clEnqueueNDRangeKernel ../src/gallium/frontends/clover/api/kernel.cpp:334

Fixes: 659b7eb ("r600: better tracking for vertex buffer emission")
Related: https://gitlab.freedesktop.org/mesa/mesa/-/issues/10079
Signed-off-by: Patrick Lerda <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29163>
(cherry picked from commit f8a1d9f)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor
set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED.
Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user
doesn't call vkDestroyPipeline() for it so the descriptor sets
referenced were never getting freed.

Addresses:
```
Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x7fa5a93ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26
    waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48
    waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56
    waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc
       ../src/vulkan/runtime/vk_descriptor_set_layout.c:49
    waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*,
       VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks
const*, VkDescriptorSetLayout_T**)
../src/freedreno/vulkan/tu_descriptor_set.cc:161
```
and
```
Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x7f9b4b3ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105
    waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:3898
    waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:4203
    waydroid#5 0x7f98b22588 in VkResult
       tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*,
VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*,
VkAllocationCallbacks const*, VkPipeline_T**)
../src/freedreno/vulkan/tu_pipeline.cc:4234
```
seen in:
dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag

Cc: mesa-stable
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188>
(cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
This change ensures that all these allocations are using
the same memory context.

For instance, this issue is triggered with:
"piglit/bin/arb_shader_image_load_store-host-mem-barrier -auto -fbo":
Indirect leak of 32816 byte(s) in 1 object(s) allocated from:
    #0 0x7f49a35447ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef)
    waydroid#1 0x7f49998e4b4f in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7f49998e7521 in create_slab ../src/util/ralloc.c:801
    waydroid#3 0x7f49998e7521 in gc_alloc_size ../src/util/ralloc.c:840
    waydroid#4 0x7f49998e7d11 in gc_zalloc_size ../src/util/ralloc.c:868
    waydroid#5 0x7f49999a6126 in nir_alu_instr_create ../src/compiler/nir/nir.c:682
    waydroid#6 0x7f49999cba48 in clone_alu ../src/compiler/nir/nir_clone.c:217
    waydroid#7 0x7f49999cc85a in clone_instr ../src/compiler/nir/nir_clone.c:456
    waydroid#8 0x7f49999cee3a in clone_block ../src/compiler/nir/nir_clone.c:529
    waydroid#9 0x7f49999cee3a in clone_cf_list ../src/compiler/nir/nir_clone.c:583
    waydroid#10 0x7f49999d03be in clone_function_impl ../src/compiler/nir/nir_clone.c:660
    waydroid#11 0x7f49999d13f7 in nir_function_impl_clone ../src/compiler/nir/nir_clone.c:678
    #12 0x7f4999a0e2c5 in lower_call_function_impl ../src/compiler/nir/nir_functions.c:397
    #13 0x7f4999a0e2c5 in function_link_pass ../src/compiler/nir/nir_functions.c:430
    #14 0x7f4999a0e2c5 in function_link_pass ../src/compiler/nir/nir_functions.c:408
    #15 0x7f4999a0e2c5 in nir_function_instructions_pass ../src/compiler/nir/nir_builder.h:108
    #16 0x7f4999a0e2c5 in nir_link_shader_functions ../src/compiler/nir/nir_functions.c:452
    #17 0x7f499ca30b8f in link_libintel_shaders ../src/gallium/drivers/iris/iris_program_cache.c:329
    #18 0x7f499ca30b8f in iris_ensure_indirect_generation_shader ../src/gallium/drivers/iris/iris_program_cache.c:374
    #19 0x7f499d185267 in gfx9_emit_indirect_generate ../src/gallium/drivers/iris/iris_indirect_gen.c:593
    #20 0x7f499d119c79 in iris_upload_indirect_shader_render_state ../src/gallium/drivers/iris/iris_state.c:8744
    #21 0x7f499fe86b01 in iris_indirect_draw_vbo ../src/gallium/drivers/iris/iris_draw.c:233
    #22 0x7f499fe86b01 in iris_draw_vbo ../src/gallium/drivers/iris/iris_draw.c:343
    #23 0x7f499a174e43 in tc_call_draw_indirect ../src/gallium/auxiliary/util/u_threaded_context.c:3828
    #24 0x7f499a1557fe in batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:453
    #25 0x7f499a1557fe in tc_batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:504
    #26 0x7f499a167f26 in _tc_sync ../src/gallium/auxiliary/util/u_threaded_context.c:761
    #27 0x7f499a168888 in tc_texture_map ../src/gallium/auxiliary/util/u_threaded_context.c:2783
    #28 0x7f49986f2631 in pipe_texture_map ../src/gallium/auxiliary/util/u_inlines.h:556
    #29 0x7f49986f2631 in _mesa_map_renderbuffer ../src/mesa/main/renderbuffer.c:494
    #30 0x7f49991af7ca in readpixels_memcpy ../src/mesa/main/readpix.c:260
    #31 0x7f49991af7ca in _mesa_readpixels ../src/mesa/main/readpix.c:898
    #32 0x7f499931ee23 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:575
    #33 0x7f49991b40b5 in read_pixels ../src/mesa/main/readpix.c:1199
    #34 0x7f49991b40b5 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1216
    #35 0x7f49991b4a20 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1231
...
SUMMARY: AddressSanitizer: 323648 byte(s) leaked in 201 allocation(s).

Fixes: 5438b19 ("iris: enable generated indirect draws")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Lionel Landwerlin <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31313>
(cherry picked from commit b6b363c)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
For instance, this issue is triggered with "piglit/bin/glsl-fs-loop -auto -fbo":
Indirect leak of 120 byte(s) in 5 object(s) allocated from:
    #0 0x7f8e7930ef57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57)
    waydroid#1 0x7f8e6dc8c68a in __gnu_cxx::new_allocator<std::_List_node<nir_intrinsic_instr*> >::allocate(unsigned long, void const*) /usr/include/c++/11.4.0/ext/new_allocator.h:127
    waydroid#2 0x7f8e6dc8c68a in std::allocator_traits<std::allocator<std::_List_node<nir_intrinsic_instr*> > >::allocate(std::allocator<std::_List_node<nir_intrinsic_instr*> >&, unsigned long) /usr/include/c++/11.4.0/bits/alloc_traits.h:464
    waydroid#3 0x7f8e6dc8c68a in std::__cxx11::_List_base<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_get_node() /usr/include/c++/11.4.0/bits/stl_list.h:443
    waydroid#4 0x7f8e6dc8c68a in std::_List_node<nir_intrinsic_instr*>* std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_create_node<nir_intrinsic_instr* const&>(nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:635
    waydroid#5 0x7f8e6dc8c68a in void std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_insert<nir_intrinsic_instr* const&>(std::_List_iterator<nir_intrinsic_instr*>, nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:1912
    waydroid#6 0x7f8e6dc8c68a in std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::push_back(nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:1213
    waydroid#7 0x7f8e6dc8c68a in r600::Shader::scan_instruction(nir_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:655
    waydroid#8 0x7f8e6dc8cc2a in r600::Shader::scan_shader(nir_function const*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:554
    waydroid#9 0x7f8e6dcab5bc in r600::Shader::process(nir_shader*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:526
    waydroid#10 0x7f8e6dcabae1 in r600::Shader::translate_from_nir(nir_shader*, pipe_stream_output_info const*, r600_shader*, r600_shader_key const&, r600_chip_class, radeon_family) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:494
    waydroid#11 0x7f8e6da5bf15 in r600_shader_from_nir ../src/gallium/drivers/r600/r600_sfn.cpp:111
    #12 0x7f8e6da5db2c in r600_pipe_shader_create ../src/gallium/drivers/r600/r600_shader.c:198
    #13 0x7f8e6da95c62 in r600_shader_select ../src/gallium/drivers/r600/r600_state_common.c:961
    #14 0x7f8e6da9c09f in r600_update_derived_state ../src/gallium/drivers/r600/r600_state_common.c:1888
    #15 0x7f8e6da9c09f in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2219
    #16 0x7f8e6d55229d in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1782
    #17 0x7f8e6c5d6322 in _mesa_draw_arrays ../src/mesa/main/draw.c:1204

Fixes: 5de8141 ("r600/sfn: Allow skipping backend shader optimization for a subset of shaders")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Gert Wollny <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27334>
(cherry picked from commit b660c73)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
For instance, this issue is triggered with "piglit/bin/glsl-vs-arrays -auto -fbo":
Direct leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x7f2fab415f57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57)
    waydroid#1 0x7f2f9fd9d541 in __gnu_cxx::new_allocator<std::__detail::_Hash_node_base*>::allocate(unsigned long, void const*) /usr/include/c++/11.4.0/ext/new_allocator.h:127
    waydroid#2 0x7f2f9fd9d541 in std::allocator_traits<std::allocator<std::__detail::_Hash_node_base*> >::allocate(std::allocator<std::__detail::_Hash_node_base*>&, unsigned long) /usr/include/c++/11.4.0/bits/alloc_traits.h:464
    waydroid#3 0x7f2f9fd9d541 in std::__detail::_Hashtable_alloc<std::allocator<std::__detail::_Hash_node<std::pair<int const, r600::Instr*>, false> > >::_M_allocate_buckets(unsigned long) /usr/include/c++/11.4.0/bits/hashtable_policy.h:1927
    waydroid#4 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_allocate_buckets(unsigned long) /usr/include/c++/11.4.0/bits/hashtable.h:440
    waydroid#5 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_rehash_aux(unsigned long, std::integral_constant<bool, true>) /usr/include/c++/11.4.0/bits/hashtable.h:2382
    waydroid#6 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_rehash(unsigned long, unsigned long const&) /usr/include/c++/11.4.0/bits/hashtable.h:2361
    waydroid#7 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_insert_unique_node(unsigned long, unsigned long, std::__detail::_Hash_node<std::pair<int const, r600::Instr*>, false>*, unsigned long) /usr/include/c++/11.4.0/bits/hashtable.h:2021
    waydroid#8 0x7f2f9fd9e7f8 in std::__detail::_Map_base<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true>, true>::operator[](int&&) /usr/include/c++/11.4.0/bits/hashtable_policy.h:741
    waydroid#9 0x7f2f9fd9f6fe in std::unordered_map<int, r600::Instr*, std::hash<int>, std::equal_to<int>, std::allocator<std::pair<int const, r600::Instr*> > >::operator[](int&&) /usr/include/c++/11.4.0/bits/unordered_map.h:984
    waydroid#10 0x7f2f9fd9f6fe in r600::Shader::InstructionChain::visit(r600::AluInstr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1358
    waydroid#11 0x7f2f9fd8f309 in r600::Shader::emit_instruction(r600::Instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1419
    #12 0x7f2f9fd8f822 in r600::RegisterReadHandler::visit(r600::LocalArray&) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1040
    #13 0x7f2f9fd8e726 in r600::Shader::emit_load_reg_indirect(nir_intrinsic_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:993
    #14 0x7f2f9fd8de5c in r600::Shader::process_instr(nir_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:848
    #15 0x7f2f9fd8de5c in r600::Shader::process_block(nir_block*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:836
    #16 0x7f2f9fd962f2 in r600::Shader::process_cf_node(nir_cf_node*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:669
    #17 0x7f2f9fdac01a in r600::Shader::process(nir_shader*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:537
    #18 0x7f2f9fdac3d1 in r600::Shader::translate_from_nir(nir_shader*, pipe_stream_output_info const*, r600_shader*, r600_shader_key const&, r600_chip_class, radeon_family) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:494
    #19 0x7f2f9fb5c8f5 in r600_shader_from_nir ../src/gallium/drivers/r600/r600_sfn.cpp:111
    #20 0x7f2f9fb5e50c in r600_pipe_shader_create ../src/gallium/drivers/r600/r600_shader.c:198
    #21 0x7f2f9fb96642 in r600_shader_select ../src/gallium/drivers/r600/r600_state_common.c:961
    #22 0x7f2f9fb97340 in r600_create_shader_state ../src/gallium/drivers/r600/r600_state_common.c:1056
    #23 0x7f2f9e060f82 in st_create_common_variant ../src/mesa/state_tracker/st_program.c:720
    #24 0x7f2f9e06e779 in st_get_common_variant ../src/mesa/state_tracker/st_program.c:773
    #25 0x7f2f9e06f78d in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1259
    #26 0x7f2f9e06f78d in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345
    #27 0x7f2f9ead0f20 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:723
    #28 0x7f2f9ead0f20 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:951
    #29 0x7f2f9e9b0d15 in link_program ../src/mesa/main/shaderapi.c:1336
    #30 0x7f2f9e9b0d15 in link_program_error ../src/mesa/main/shaderapi.c:1447

Fixes: ddb167e ("r600/sfn: Handle indirect array load/store dependencies better")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Gert Wollny <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27334>
(cherry picked from commit 242da61)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
Addresses:
```
Direct leak of 192 byte(s) in 1 object(s) allocated from:
    #0 0x7fbe5e4230 in __interceptor_realloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    waydroid#1 0x7fbd008bf4 in vk_default_realloc
       ../src/vulkan/util/vk_alloc.c:37
    waydroid#2 0x7fbbabb2fc in vk_realloc ../src/vulkan/util/vk_alloc.h:70
    waydroid#3 0x7fbbaead38 in tu_push_descriptor_set_update_layout
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3173
    waydroid#4 0x7fbbaeb0b4 in tu_push_descriptor_set
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3203
    waydroid#5 0x7fbbaeb500 in tu_CmdPushDescriptorSet2KHR(VkCommandBuffer_T*,
       VkPushDescriptorSetInfoKHR const*)
../src/freedreno/vulkan/tu_cmd_buffer.cc:3235
    waydroid#6 0x7fbbe35c80 in vk_common_CmdPushDescriptorSetKHR
       ../src/vulkan/runtime/vk_command_buffer.c:300
```
seen in:
dEQP-VK.binding_model.shader_access.secondary_cmd_buf.bind.with_push.sampler_mutable.tess_eval.multiple_discontiguous_descriptors.1d_array

Fixes: 03294e1 ("turnip: Keep a host copy of push descriptor sets.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit 53c2d5e426d8a5b919ea3c64bad9e46b354b2fc9)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
We can end up calling vk_multialloc_alloc with 0 size when
`attachment_count` is 0 and `clearValueCount` is 0.

Addressed:
```
Direct leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x7faf033ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fada5cc10 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26
    waydroid#2 0x7fac50b270 in vk_alloc ../src/vulkan/util/vk_alloc.h:48
    waydroid#3 0x7fac555040 in vk_multialloc_alloc
       ../src/vulkan/util/vk_alloc.h:234
    waydroid#4 0x7fac555040 in void
       tu_CmdBeginRenderPass2<(chip)7>(VkCommandBuffer_T*,
VkRenderPassBeginInfo const*, VkSubpassBeginInfo const*)
../src/freedreno/vulkan/tu_cmd_buffer.cc:4634
    waydroid#5 0x7fac900760 in vk_common_CmdBeginRenderPass
       ../src/vulkan/runtime/vk_render_pass.c:261
```
seen in:
dEQP-VK.robustness.robustness2.bind.notemplate.r32i.dontunroll.nonvolatile.uniform_texel_buffer.no_fmt_qual.len_252.samples_1.1d.frag

Fixes: 4cfd021 ("turnip: Save the renderpass's clear values in the cmdbuf state.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit c923eff742b83cc475d02ad57c538754db991c06)
Kaz205 pushed a commit to Kaz205/android_external_mesa3d that referenced this issue Nov 26, 2024
Addresses:
```
Indirect leak of 256 byte(s) in 2 object(s) allocated from:
    #0 0x7faaf53ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fa8cfe900 in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7fa8cfeb20 in rzalloc_size ../src/util/ralloc.c:152
    waydroid#3 0x7fa8cff004 in rzalloc_array_size ../src/util/ralloc.c:232
    waydroid#4 0x7fa8d06a84 in _mesa_set_init ../src/util/set.c:133
    waydroid#5 0x7fa8d06bcc in _mesa_set_create ../src/util/set.c:152
    waydroid#6 0x7fa8d0939c in _mesa_pointer_set_create ../src/util/set.c:613
    waydroid#7 0x7fa95e5790 in nir_lower_mediump_vars
       ../src/compiler/nir/nir_lower_mediump.c:574
    waydroid#8 0x7fa862c1c8 in tu_spirv_to_nir(tu_device*, void*, unsigned long,
       VkPipelineShaderStageCreateInfo const*, tu_shader_key const*,
pipe_shader_type) ../src/freedreno/vulkan/tu_shader.cc:116
    waydroid#9 0x7fa8646f24 in tu_compile_shaders(tu_device*, unsigned long,
       VkPipelineShaderStageCreateInfo const**, nir_shader**,
tu_shader_key const*, tu_pipeline_layout*, unsigned char const*,
tu_shader**, char**, void*, nir_shader**, VkPipelineCreationFeedback*)
../src/freedreno/vulkan/tu_shader.cc:2741
    waydroid#10 0x7fa85a16a4 in tu_pipeline_builder_compile_shaders
	../src/freedreno/vulkan/tu_pipeline.cc:1887
    waydroid#11 0x7fa85eb844 in tu_pipeline_builder_build<(chip)7>
	../src/freedreno/vulkan/tu_pipeline.cc:3923
    #12 0x7fa85e6bd8 in tu_graphics_pipeline_create<(chip)7>
	../src/freedreno/vulkan/tu_pipeline.cc:4203
    #13 0x7fa85c2588 in VkResult
	tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*,
VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*,
VkAllocationCallbacks const*, VkPipeline_T**)
../src/freedreno/vulkan/tu_pipeline.cc:4234
```
seen in:
dEQP-VK.binding_model.mutable_descriptor.single.switches.uniform_texel_buffer_storage_image.update_write.no_source.no_source.pool_expand_types.pre_update.no_array.vert

Fixes: 7e986e5 ("nir/lower_mediump_vars: Don't lower mediump shared vars with atomic access.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit 2a7df331af65216e0229fe6481c1eca70221b225)
supechicken pushed a commit to Waydroid-ATV/android_external_mesa3d that referenced this issue Nov 29, 2024
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor
set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED.
Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user
doesn't call vkDestroyPipeline() for it so the descriptor sets
referenced were never getting freed.

Addresses:
```
Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x7fa5a93ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26
    waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48
    waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56
    waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc
       ../src/vulkan/runtime/vk_descriptor_set_layout.c:49
    waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*,
       VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks
const*, VkDescriptorSetLayout_T**)
../src/freedreno/vulkan/tu_descriptor_set.cc:161
```
and
```
Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x7f9b4b3ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105
    waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:3898
    waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:4203
    waydroid#5 0x7f98b22588 in VkResult
       tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*,
VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*,
VkAllocationCallbacks const*, VkPipeline_T**)
../src/freedreno/vulkan/tu_pipeline.cc:4234
```
seen in:
dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag

Cc: mesa-stable
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188>
(cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
supechicken pushed a commit to Waydroid-ATV/android_external_mesa3d that referenced this issue Nov 29, 2024
Addresses:
```
Direct leak of 192 byte(s) in 1 object(s) allocated from:
    #0 0x7fbe5e4230 in __interceptor_realloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    waydroid#1 0x7fbd008bf4 in vk_default_realloc
       ../src/vulkan/util/vk_alloc.c:37
    waydroid#2 0x7fbbabb2fc in vk_realloc ../src/vulkan/util/vk_alloc.h:70
    waydroid#3 0x7fbbaead38 in tu_push_descriptor_set_update_layout
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3173
    waydroid#4 0x7fbbaeb0b4 in tu_push_descriptor_set
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3203
    waydroid#5 0x7fbbaeb500 in tu_CmdPushDescriptorSet2KHR(VkCommandBuffer_T*,
       VkPushDescriptorSetInfoKHR const*)
../src/freedreno/vulkan/tu_cmd_buffer.cc:3235
    waydroid#6 0x7fbbe35c80 in vk_common_CmdPushDescriptorSetKHR
       ../src/vulkan/runtime/vk_command_buffer.c:300
```
seen in:
dEQP-VK.binding_model.shader_access.secondary_cmd_buf.bind.with_push.sampler_mutable.tess_eval.multiple_discontiguous_descriptors.1d_array

Fixes: 03294e1 ("turnip: Keep a host copy of push descriptor sets.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit 53c2d5e426d8a5b919ea3c64bad9e46b354b2fc9)
supechicken pushed a commit to Waydroid-ATV/android_external_mesa3d that referenced this issue Nov 29, 2024
We can end up calling vk_multialloc_alloc with 0 size when
`attachment_count` is 0 and `clearValueCount` is 0.

Addressed:
```
Direct leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x7faf033ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fada5cc10 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26
    waydroid#2 0x7fac50b270 in vk_alloc ../src/vulkan/util/vk_alloc.h:48
    waydroid#3 0x7fac555040 in vk_multialloc_alloc
       ../src/vulkan/util/vk_alloc.h:234
    waydroid#4 0x7fac555040 in void
       tu_CmdBeginRenderPass2<(chip)7>(VkCommandBuffer_T*,
VkRenderPassBeginInfo const*, VkSubpassBeginInfo const*)
../src/freedreno/vulkan/tu_cmd_buffer.cc:4634
    waydroid#5 0x7fac900760 in vk_common_CmdBeginRenderPass
       ../src/vulkan/runtime/vk_render_pass.c:261
```
seen in:
dEQP-VK.robustness.robustness2.bind.notemplate.r32i.dontunroll.nonvolatile.uniform_texel_buffer.no_fmt_qual.len_252.samples_1.1d.frag

Fixes: 4cfd021 ("turnip: Save the renderpass's clear values in the cmdbuf state.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit c923eff742b83cc475d02ad57c538754db991c06)
supechicken pushed a commit to Waydroid-ATV/android_external_mesa3d that referenced this issue Nov 29, 2024
Addresses:
```
Indirect leak of 256 byte(s) in 2 object(s) allocated from:
    #0 0x7faaf53ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fa8cfe900 in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7fa8cfeb20 in rzalloc_size ../src/util/ralloc.c:152
    waydroid#3 0x7fa8cff004 in rzalloc_array_size ../src/util/ralloc.c:232
    waydroid#4 0x7fa8d06a84 in _mesa_set_init ../src/util/set.c:133
    waydroid#5 0x7fa8d06bcc in _mesa_set_create ../src/util/set.c:152
    waydroid#6 0x7fa8d0939c in _mesa_pointer_set_create ../src/util/set.c:613
    waydroid#7 0x7fa95e5790 in nir_lower_mediump_vars
       ../src/compiler/nir/nir_lower_mediump.c:574
    waydroid#8 0x7fa862c1c8 in tu_spirv_to_nir(tu_device*, void*, unsigned long,
       VkPipelineShaderStageCreateInfo const*, tu_shader_key const*,
pipe_shader_type) ../src/freedreno/vulkan/tu_shader.cc:116
    waydroid#9 0x7fa8646f24 in tu_compile_shaders(tu_device*, unsigned long,
       VkPipelineShaderStageCreateInfo const**, nir_shader**,
tu_shader_key const*, tu_pipeline_layout*, unsigned char const*,
tu_shader**, char**, void*, nir_shader**, VkPipelineCreationFeedback*)
../src/freedreno/vulkan/tu_shader.cc:2741
    waydroid#10 0x7fa85a16a4 in tu_pipeline_builder_compile_shaders
	../src/freedreno/vulkan/tu_pipeline.cc:1887
    waydroid#11 0x7fa85eb844 in tu_pipeline_builder_build<(chip)7>
	../src/freedreno/vulkan/tu_pipeline.cc:3923
    #12 0x7fa85e6bd8 in tu_graphics_pipeline_create<(chip)7>
	../src/freedreno/vulkan/tu_pipeline.cc:4203
    #13 0x7fa85c2588 in VkResult
	tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*,
VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*,
VkAllocationCallbacks const*, VkPipeline_T**)
../src/freedreno/vulkan/tu_pipeline.cc:4234
```
seen in:
dEQP-VK.binding_model.mutable_descriptor.single.switches.uniform_texel_buffer_storage_image.update_write.no_source.no_source.pool_expand_types.pre_update.no_array.vert

Fixes: 7e986e5 ("nir/lower_mediump_vars: Don't lower mediump shared vars with atomic access.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit 2a7df331af65216e0229fe6481c1eca70221b225)
supechicken pushed a commit to Waydroid-ATV/android_external_mesa3d that referenced this issue Nov 29, 2024
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor
set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED.
Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user
doesn't call vkDestroyPipeline() for it so the descriptor sets
referenced were never getting freed.

Addresses:
```
Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x7fa5a93ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26
    waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48
    waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56
    waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc
       ../src/vulkan/runtime/vk_descriptor_set_layout.c:49
    waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*,
       VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks
const*, VkDescriptorSetLayout_T**)
../src/freedreno/vulkan/tu_descriptor_set.cc:161
```
and
```
Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x7f9b4b3ee0 in __interceptor_malloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118
    waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105
    waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:3898
    waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7>
       ../src/freedreno/vulkan/tu_pipeline.cc:4203
    waydroid#5 0x7f98b22588 in VkResult
       tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*,
VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*,
VkAllocationCallbacks const*, VkPipeline_T**)
../src/freedreno/vulkan/tu_pipeline.cc:4234
```
seen in:
dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag

Cc: mesa-stable
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188>
(cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants