-
Notifications
You must be signed in to change notification settings - Fork 21
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NV12 support in libgbm #4
Comments
@fooishbar this is the issue regarding Waydroid and NV12 in Mesa we shortly talked about at FOSDEM - you said you might have something in mind? |
@rmader thanks for the tag! @jmondi you're right that it is indeed the Graphics Buffer Manager, not Generic. You can often use GBM as a proxy for gralloc, but not always. In particular, Mesa doesn't implement NV12 as a BO/surface type for alloc, because we don't (currently) have support for NV12 as a GPU render target. NV12 imports may work directly, or you may need to separately import each plane as R8/GR88 and do the CSC yourself. I guess the three paths I can see are:
|
For instance, with "piglit/bin/arb_shader_image_load_store-host-mem-barrier --quick -auto -fbo": ==18549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000a059 at pc 0x7f65d8937b80 bp 0x7fff6ed19a00 sp 0x7fff6ed199f8 READ of size 1 at 0x61200000a059 thread T0 #0 0x7f65d8937b7f in evergreen_set_shader_images ../src/gallium/drivers/r600/evergreen_state.c:4277 #1 0x7f65d6b471b8 in st_bind_images ../src/mesa/state_tracker/st_atom_image.c:172 #2 0x7f65d6b76b26 in st_validate_state ../src/mesa/state_tracker/st_util.h:129 #3 0x7f65d6b76b26 in prepare_draw ../src/mesa/state_tracker/st_draw.c:88 #4 0x7f65d6b77c8a in st_draw_gallium ../src/mesa/state_tracker/st_draw.c:141 #5 0x7f65d72698a2 in _mesa_draw_arrays ../src/mesa/main/draw.c:1202 Fixes: a6b3792 ("r600: add core pieces of image support.") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Gert Wollny <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22273> (cherry picked from commit e0ed2b2)
This change is inspired from iris_destroy_context(). For instance, this issue is triggered with "piglit/bin/glsl-1.50-gs-max-output -scan 1 20 -auto -fbo": Direct leak of 320 byte(s) in 2 object(s) allocated from: #0 0x7f34fc769987 in calloc (/usr/lib64/libasan.so.6+0xb1987) waydroid#1 0x7f34f4fa168a in bo_calloc ../src/gallium/drivers/crocus/crocus_bufmgr.c:288 waydroid#2 0x7f34f4fa168a in alloc_fresh_bo ../src/gallium/drivers/crocus/crocus_bufmgr.c:350 waydroid#3 0x7f34f4fa168a in bo_alloc_internal ../src/gallium/drivers/crocus/crocus_bufmgr.c:419 waydroid#4 0x7f34f4fe50a9 in crocus_get_scratch_space ../src/gallium/drivers/crocus/crocus_program.c:2678 waydroid#5 0x7f34f55e8954 in crocus_upload_dirty_render_state ../src/gallium/drivers/crocus/crocus_state.c:6871 waydroid#6 0x7f34f55e8954 in crocus_upload_render_state ../src/gallium/drivers/crocus/crocus_state.c:7812 waydroid#7 0x7f34f5d9f680 in crocus_simple_draw_vbo ../src/gallium/drivers/crocus/crocus_draw.c:332 waydroid#8 0x7f34f5d9f680 in crocus_draw_vbo ../src/gallium/drivers/crocus/crocus_draw.c:438 waydroid#9 0x7f34f1d2eeba in tc_call_draw_single ../src/gallium/auxiliary/util/u_threaded_context.c:3735 waydroid#10 0x7f34f1d12e03 in batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:394 waydroid#11 0x7f34f1d12e03 in tc_batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:445 #12 0x7f34f1d22c9a in _tc_sync ../src/gallium/auxiliary/util/u_threaded_context.c:680 #13 0x7f34f1d238f8 in tc_texture_map ../src/gallium/auxiliary/util/u_threaded_context.c:2754 #14 0x7f34f120b9d9 in pipe_texture_map_3d ../src/gallium/auxiliary/util/u_inlines.h:579 #15 0x7f34f120b9d9 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:530 #16 0x7f34f10d7355 in read_pixels ../src/mesa/main/readpix.c:1178 #17 0x7f34f10d7355 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1195 #18 0x7f34f10d7e10 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1210 Fixes: f363054 ("f3630548f1da crocus: initial gallium driver for Intel gfx 4-7") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Filip Gawin <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23019> (cherry picked from commit 6ee0bba)
For instance, this is triggered with "piglit/bin/ext_direct_state_access-named-program -auto -fbo": ==5695==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000050031 at pc 0x7f78dfca8d46 bp 0x7ffd9043b4a0 sp 0x7ffd9043ac50 READ of size 50 at 0x606000050031 thread T0 #0 0x7f78dfca8d45 (/usr/lib64/libasan.so.6+0x3fd45) #1 0x7f78d450b18f in set_program_string ../src/mesa/main/arbprogram.c:385 #2 0x7f78d3fdbd3e in execute_list ../src/mesa/main/dlist.c:13025 #3 0x7f78d40c2564 in _mesa_CallList ../src/mesa/main/dlist.c:13451 #4 0x7f78d42f380a in _mesa_unmarshal_CallList ../src/mesa/main/glthread_list.c:43 #5 0x7f78d38e85c5 in glthread_unmarshal_batch ../src/mesa/main/glthread.c:122 #6 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:382 #7 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:347 #8 0x7f78d3d73f69 in _mesa_marshal_IsProgramARB src/mapi/glapi/gen/marshal_generated2.c:4256 Fixes: 0b196b4 ("mesa: don't compute the same SHA1 twice in glShaderSource") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23295> (cherry picked from commit 44b960a)
The previous implementation was copying the data using the aligned length (size_dw). The aligned length could overflow the original buffer size. For instance, this issue is triggered with "piglit/bin/draw-batch -auto -fbo": ==5736==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff139c77e8 at pc 0x7f25b350a9a0 bp 0x7fff139c6cb0 sp 0x7fff139c6460 READ of size 8 at 0x7fff139c77e8 thread T0 #0 0x7f25b350a99f in __interceptor_memcpy (/usr/lib64/libasan.so.6+0x3c99f) #1 0x7f25a8fcdf24 in radeon_emit_array ../src/gallium/include/winsys/radeon_winsys.h:760 #2 0x7f25a8fcdf24 in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2448 #3 0x7f25a8ae7ba1 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1791 #4 0x7f25a7bc18ca in _mesa_validated_drawrangeelements ../src/mesa/main/draw.c:1696 #5 0x7f25a7bc7e53 in _mesa_DrawElements ../src/mesa/main/draw.c:1824 Fixes: 0cf5d1f ("gallium: remove PIPE_CAP_INFO_START_WITH_USER_INDICES and fix all drivers") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23436> (cherry picked from commit 340311d)
Indeed, this function was not processing the linked allocated list. For instance, this issue is triggered with "piglit/bin/hiz-depth-read-fbo-d24-s0 -auto": Indirect leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f6795638987 in calloc (/usr/lib64/libasan.so.6+0xb1987) #1 0x7f678bac13b9 in nouveau_heap_alloc ../src/gallium/drivers/nouveau/nouveau_heap.c:64 #2 0x7f678bb6c7e4 in nv50_program_upload_code ../src/gallium/drivers/nouveau/nv50/nv50_program.c:490 #3 0x7f678bb83b92 in nv50_vertprog_validate ../src/gallium/drivers/nouveau/nv50/nv50_shader_state.c:161 #4 0x7f678bba3000 in nv50_state_validate ../src/gallium/drivers/nouveau/nv50/nv50_state_validate.c:552 #5 0x7f678bba3c4d in nv50_state_validate_3d ../src/gallium/drivers/nouveau/nv50/nv50_state_validate.c:575 #6 0x7f678b9e3e92 in nv50_blit_3d ../src/gallium/drivers/nouveau/nv50/nv50_surface.c:1444 #7 0x7f678b9e3e92 in nv50_blit ../src/gallium/drivers/nouveau/nv50/nv50_surface.c:1832 #8 0x7f678a0b378a in blit_to_staging ../src/mesa/state_tracker/st_cb_readpixels.c:337 #9 0x7f678a0b7358 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:516 #10 0x7f6789f82005 in read_pixels ../src/mesa/main/readpix.c:1178 #11 0x7f6789f82005 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1195 #12 0x7f6789f82ac0 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1210 ... SUMMARY: AddressSanitizer: 80 byte(s) leaked in 2 allocation(s). Fixes: 67635a0 ("nouveau: get rid of tabs") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Karol Herbst <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23592> (cherry picked from commit 1980934)
This change fixes a buffer overflow by implementing the special swizzles. This behavior is already available with evergreen_convert_border_color(). For instance, this issue is triggered on a cayman gpu with "piglit/bin/texwrap bordercolor -auto -fbo" or "piglit/bin/max-samplers -auto -fbo": ==5610==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000012d20 at pc 0x7fb798cb876f bp 0x7ffd78670460 sp 0x7ffd78670458 READ of size 4 at 0x603000012d20 thread T0 #0 0x7fb798cb876e in cayman_convert_border_color ../src/gallium/drivers/r600/evergreen_state.c:2444 #1 0x7fb798cb876e in evergreen_emit_sampler_states ../src/gallium/drivers/r600/evergreen_state.c:2539 #2 0x7fb7989e6cb2 in r600_emit_atom ../src/gallium/drivers/r600/r600_pipe.h:655 #3 0x7fb7989e6cb2 in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2333 #4 0x7fb7985082c7 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1497 #5 0x7fb796ef2eda in cso_draw_vbo ../src/gallium/auxiliary/cso_cache/cso_context.h:262 #6 0x7fb796ef2eda in st_draw_gallium_multimode ../src/mesa/state_tracker/st_draw.c:170 #7 0x7fb7970d9cfd in vbo_exec_vtx_flush ../src/mesa/vbo/vbo_exec_draw.c:341 #8 0x7fb7970d32d7 in vbo_exec_FlushVertices_internal ../src/mesa/vbo/vbo_exec_api.c:693 #9 0x7fb7970d32d7 in vbo_exec_FlushVertices ../src/mesa/vbo/vbo_exec_api.c:1193 #10 0x7fb7975f237c in enable_texture ../src/mesa/main/enable.c:337 Fixes: 923d635 ("r600: fix some border color swizzles on CAYMAN") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Gert Wollny <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23435> (cherry picked from commit 4284705)
../src/panfrost/compiler/compiler.h:89:14: runtime error: left shift of 51966 by 16 places cannot be represented in type 'int' #0 0x55c72fd7dda4 in bi_apply_swizzle ../src/panfrost/compiler/compiler.h:89 #1 0x55c72fd808d6 in bi_source_value ../src/panfrost/compiler/bi_opt_constant_fold.c:35 #2 0x55c72fd80a83 in bi_fold_constant ../src/panfrost/compiler/bi_opt_constant_fold.c:52 #3 0x55c72fb2080c in constant_fold_pred ../src/panfrost/compiler/test/test-constant-fold.cpp:48 #4 0x55c72fb21a65 in ConstantFold_Swizzles_Test::TestBody() ../src/panfrost/compiler/test/test-constant-fold.cpp:103 #5 0x55c73070cc97 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../src/gtest/src/gtest.cc:2621 #6 0x55c7306f0df7 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ../src/gtest/src/gtest.cc:2657 #7 0x55c730694add in testing::Test::Run() ../src/gtest/src/gtest.cc:2696 #8 0x55c73069798d in testing::TestInfo::Run() ../src/gtest/src/gtest.cc:2845 #9 0x55c73069b684 in testing::TestSuite::Run() ../src/gtest/src/gtest.cc:3004 #10 0x55c7306ccfcb in testing::internal::UnitTestImpl::RunAllTests() ../src/gtest/src/gtest.cc:5890 #11 0x55c73071053c in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../src/gtest/src/gtest.cc:2621 #12 0x55c7306f4ed3 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) ../src/gtest/src/gtest.cc:2657 #13 0x55c7306c23fa in testing::UnitTest::Run() ../src/gtest/src/gtest.cc:5455 #14 0x55c730748faf in RUN_ALL_TESTS() ../src/gtest/include/gtest/gtest.h:2314 #15 0x55c730748ffa in main ../src/gtest/src/gtest_main.cc:63 #16 0x7f8554bcc1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #17 0x7f8554bcc284 in __libc_start_main_impl ../csu/libc-start.c:360 #18 0x55c72fb18be0 in _start (/builds/mesa/mesa/_build/src/panfrost/compiler/bifrost_tests+0xbd0be0) Cc: mesa-stable Signed-off-by: Eric Engestrom <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24610> (cherry picked from commit 54c7099)
For instance, this issue is triggered with "piglit/bin/ext_framebuffer_multisample-accuracy all_samples color depthstencil -auto -fbo": Direct leak of 1160 byte(s) in 1 object(s) allocated from: #0 0x7fbe8897d7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7fbe7e7abfcc in rc_constants_copy ../src/gallium/drivers/r300/compiler/radeon_code.c:47 #2 0x7fbe7e7ec902 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:174 #3 0x7fbe7e7e1b22 in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516 #4 0x7fbe7e7e6373 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:591 #5 0x7fbe7e75456e in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1073 #6 0x7fbe7cd2ebe5 in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1070 #7 0x7fbe7cd374b5 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1116 #8 0x7fbe7cd38273 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1281 #9 0x7fbe7cd38273 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345 #10 0x7fbe7d798ca8 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:724 #11 0x7fbe7d798ca8 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:952 #12 0x7fbe7d6790d5 in link_program ../src/mesa/main/shaderapi.c:1336 #13 0x7fbe7d6790d5 in link_program_error ../src/mesa/main/shaderapi.c:1447 ... SUMMARY: AddressSanitizer: 2528456 byte(s) leaked in 1057 allocation(s). Fixes: 54f6e72 ("r300: better register allocator for vertex shaders") Signed-off-by: Patrick Lerda <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27792> (cherry picked from commit 4d00edd)
For instance, this issue is triggered with "piglit/bin/object-namespace-pollution glBitmap program -auto -fbo": Direct leak of 112 byte(s) in 7 object(s) allocated from: #0 0x7f472540e7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f471a9ce18f in rc_remove_unused_constants ../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:101 #2 0x7f471a9b0836 in rc_run_compiler_passes ../src/gallium/drivers/r300/compiler/radeon_compiler.c:476 #3 0x7f471a9b0ad5 in rc_run_compiler ../src/gallium/drivers/r300/compiler/radeon_compiler.c:498 #4 0x7f471a9ec862 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:172 #5 0x7f471a9e1ab2 in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516 #6 0x7f471a9e6303 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:591 #7 0x7f471a9544fe in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1073 #8 0x7f4718f2ebe5 in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1070 #9 0x7f4718f374b5 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1116 #10 0x7f4718f38273 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1281 #11 0x7f4718f38273 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345 #12 0x7f4718f389e9 in st_program_string_notify ../src/mesa/state_tracker/st_program.c:1378 #13 0x7f47199d9f99 in set_program_string ../src/mesa/main/arbprogram.c:413 Fixes: 1c2c4dd ("r300g: copy the compiler from r300c") Signed-off-by: Patrick Lerda <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27957> (cherry picked from commit 29df857)
Indeed, main_shader_part_ngg_es was not freed. For instance, this issue is triggered on a radeonsi/gfx10 gpu with "piglit/bin/arb_gpu_shader5-tf-wrong-stream-value -auto -fbo": Direct leak of 1464 byte(s) in 1 object(s) allocated from: #0 0x7f17904b99a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7) #1 0x7f1785d65ac2 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3132 #2 0x7f1783af67d8 in util_queue_thread_func ../src/util/u_queue.c:309 #3 0x7f1783b51dfa in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #4 0x7f178f69d38a (/lib64/libc.so.6+0x8438a) Indirect leak of 2024 byte(s) in 1 object(s) allocated from: #0 0x7f17904b97ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f1785d5443a in read_chunk ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:221 #2 0x7f1785d62cf5 in si_load_shader_binary ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:293 #3 0x7f1785d65255 in si_shader_cache_load_shader ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:423 #4 0x7f1785d65ef9 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3169 #5 0x7f1783af67d8 in util_queue_thread_func ../src/util/u_queue.c:309 #6 0x7f1783b51dfa in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #7 0x7f178f69d38a (/lib64/libc.so.6+0x8438a) Fixes: 8f72f13 ("radeonsi/gfx10: add as_ngg variant for TES as ES to select Wave32/64") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Pierre-Eric Pelloux-Prayer <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27958> (cherry picked from commit f93f215)
…rors For instance, this issue is triggered with "piglit/bin/glslparsertest tests/spec/arb_bindless_texture/compiler/images/arith-bound-image.frag pass 3.30 GL_ARB_bindless_texture GL_ARB_shader_image_load_store": Direct leak of 176 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbe9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7) #1 0x7f84ba7e0801 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4391 #2 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759 #3 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836 #4 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #5 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #6 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #7 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #8 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbff57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57) #1 0x7f84b1a5f749 in LLVMCreateBuilderInContext (/usr/local/lib64/libLLVM-17.so+0xc84749) #2 0x7f84ba7817b0 in ac_llvm_context_init ../src/amd/llvm/ac_llvm_build.c:54 #3 0x7f84ba542b7a in si_llvm_context_init ../src/gallium/drivers/radeonsi/si_shader_llvm.c:120 #4 0x7f84ba542b7a in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:832 #5 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #6 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #7 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #8 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #9 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) Indirect leak of 176 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118 #2 0x7f84b81b9fee in rzalloc_size ../src/util/ralloc.c:152 #3 0x7f84b81b9fee in rzalloc_array_size ../src/util/ralloc.c:232 #4 0x7f84b81b05c7 in _mesa_hash_table_init ../src/util/hash_table.c:163 #5 0x7f84b81b05c7 in _mesa_hash_table_create ../src/util/hash_table.c:186 #6 0x7f84ba7e06ae in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4381 #7 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759 #8 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836 #9 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #10 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #11 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #12 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #13 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) Indirect leak of 176 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118 #2 0x7f84b81b9fee in rzalloc_size ../src/util/ralloc.c:152 #3 0x7f84b81b9fee in rzalloc_array_size ../src/util/ralloc.c:232 #4 0x7f84b81b05c7 in _mesa_hash_table_init ../src/util/hash_table.c:163 #5 0x7f84b81b05c7 in _mesa_hash_table_create ../src/util/hash_table.c:186 #6 0x7f84ba7e06e4 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4382 #7 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759 #8 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836 #9 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #10 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #11 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #12 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #13 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) Indirect leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118 #2 0x7f84b81b046c in _mesa_hash_table_create ../src/util/hash_table.c:182 #3 0x7f84ba7e06e4 in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4382 #4 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759 #5 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836 #6 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #7 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #8 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #9 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #10 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) Indirect leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f84c3fbe7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f84b81b9b3f in ralloc_size ../src/util/ralloc.c:118 #2 0x7f84b81b046c in _mesa_hash_table_create ../src/util/hash_table.c:182 #3 0x7f84ba7e06ae in ac_nir_translate ../src/amd/llvm/ac_nir_to_llvm.c:4381 #4 0x7f84ba53fdf4 in si_llvm_translate_nir ../src/gallium/drivers/radeonsi/si_shader_llvm.c:759 #5 0x7f84ba542bb7 in si_llvm_compile_shader ../src/gallium/drivers/radeonsi/si_shader_llvm.c:836 #6 0x7f84ba337b8e in si_compile_shader ../src/gallium/drivers/radeonsi/si_shader.c:2874 #7 0x7f84ba43a7c1 in si_init_shader_selector_async ../src/gallium/drivers/radeonsi/si_state_shaders.cpp:3176 #8 0x7f84b81c3448 in util_queue_thread_func ../src/util/u_queue.c:309 #9 0x7f84b821ea6a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 #10 0x7f84c2fea38a (/lib64/libc.so.6+0x8438a) SUMMARY: AddressSanitizer: 920 byte(s) leaked in 6 allocation(s). Fixes: d92d35c ("ac/llvm: add a return value to ac_nir_translate") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28099> (cherry picked from commit 0fd907f)
…er path A last memory leak related to constants_remap_table is happening. This memory leak is triggered by two deqp-gles2 tests. For instance, this issue is triggered with "deqp-gles2 --deqp-case=dEQP-GLES2.functional.uniform_api.random.13": Direct leak of 336 byte(s) in 1 object(s) allocated from: #0 0x7f1b4a5de7ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) #1 0x7f1b401a2cdf in rc_remove_unused_constants ../src/gallium/drivers/r300/compiler/radeon_remove_constants.c:101 #2 0x7f1b40185386 in rc_run_compiler_passes ../src/gallium/drivers/r300/compiler/radeon_compiler.c:476 #3 0x7f1b40185625 in rc_run_compiler ../src/gallium/drivers/r300/compiler/radeon_compiler.c:498 #4 0x7f1b401c14d2 in r3xx_compile_fragment_program ../src/gallium/drivers/r300/compiler/r3xx_fragprog.c:172 #5 0x7f1b401b669a in r300_translate_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:516 #6 0x7f1b401baf73 in r300_pick_fragment_shader ../src/gallium/drivers/r300/r300_fs.c:592 #7 0x7f1b40128db7 in r300_create_fs_state ../src/gallium/drivers/r300/r300_state.c:1071 #8 0x7f1b3e67799d in st_create_fp_variant ../src/mesa/state_tracker/st_program.c:1073 #9 0x7f1b3e680285 in st_get_fp_variant ../src/mesa/state_tracker/st_program.c:1119 #10 0x7f1b3e6812fa in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1284 #11 0x7f1b3e6812fa in st_finalize_program ../src/mesa/state_tracker/st_program.c:1363 #12 0x7f1b3f13d501 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:754 #13 0x7f1b3f13d501 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:990 #14 0x7f1b3efeef75 in link_program ../src/mesa/main/shaderapi.c:1336 #15 0x7f1b3efeef75 in link_program_error ../src/mesa/main/shaderapi.c:1445 Fixes: 29df857 ("r300: fix constants_remap_table memory leak") Signed-off-by: Patrick Lerda <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28522> (cherry picked from commit 24a5165)
Indeed, the pointer processed by r300_upload_index_buffer() was not the right one. This is the reason why "deqp-gles2 --deqp-case=dEQP-GLES2.functional.draw.draw_elements.indices.user_ptr.index_byte" was failing (the logs are below). This change corrects this issue and makes the related deqp tests work properly. This change considers that r300_upload_index_buffer() sets indexBuffer to NULL. The indexBuffer resource should be properly freed once the buffer is processed. This is required to avoid another refcnt imbalance (another kind of memory leak). ==9962==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000721f at pc 0x7fd57b54a9a0 bp 0x7fffd2c39290 sp 0x7fffd2c38a40 READ of size 30 at 0x60200000721f thread T0 #0 0x7fd57b54a99f in __interceptor_memcpy (/usr/lib64/libasan.so.6.0.0+0x3c99f) #1 0x7fd570d10528 in u_upload_data ../src/gallium/auxiliary/util/u_upload_mgr.c:333 #2 0x7fd57114142b in r300_upload_index_buffer ../src/gallium/drivers/r300/r300_screen_buffer.c:44 #3 0x7fd57113943c in r300_draw_elements ../src/gallium/drivers/r300/r300_render.c:632 #4 0x7fd57113bbc4 in r300_draw_vbo ../src/gallium/drivers/r300/r300_render.c:840 #5 0x7fd570d212e2 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1487 #6 0x7fd56fceb873 in _mesa_validated_drawrangeelements ../src/mesa/main/draw.c:1709 #7 0x7fd56fcf28c5 in _mesa_DrawElementsBaseVertex ../src/mesa/main/draw.c:1852 Fixes: 330d060 ("gallium: remove pipe_index_buffer and set_index_buffer") Signed-off-by: Patrick Lerda <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28523> (cherry picked from commit 2b6993c)
The pointer "xfb" is allocated with a clone of "so->nir" and lost without further processing. The function panfrost_shader_compile() was the one processing "xfb". The call of this function was removed with the commit 40372bd. This makes "xfb" not required anymore. For instance, this issue is triggered on a Mali-T820 with "piglit/bin/arb_transform_feedback2-change-objects-while-paused -auto": Indirect leak of 32776 byte(s) in 1 object(s) allocated from: #0 0xf78f30a6 in malloc (/usr/lib/libasan.so.6+0x840a6) #1 0xee9cd4ee in ralloc_size ../src/util/ralloc.c:118 #2 0xee9cf7ae in create_slab ../src/util/ralloc.c:801 #3 0xee9cf7ae in gc_alloc_size ../src/util/ralloc.c:840 #4 0xef74ab82 in nir_undef_instr_create ../src/compiler/nir/nir.c:888 #5 0xef76212c in clone_ssa_undef ../src/compiler/nir/nir_clone.c:328 #6 0xef76212c in clone_instr ../src/compiler/nir/nir_clone.c:438 #7 0xef7642d8 in clone_block ../src/compiler/nir/nir_clone.c:501 #8 0xef7642d8 in clone_cf_list ../src/compiler/nir/nir_clone.c:555 #9 0xef7657dc in clone_function_impl ../src/compiler/nir/nir_clone.c:632 #10 0xef766cb8 in nir_shader_clone ../src/compiler/nir/nir_clone.c:743 #11 0xf007673e in panfrost_create_shader_state ../src/gallium/drivers/panfrost/pan_shader.c:434 #12 0xeeb6766c in st_create_common_variant ../src/mesa/state_tracker/st_program.c:781 #13 0xeeb71d1c in st_get_common_variant ../src/mesa/state_tracker/st_program.c:834 #14 0xeeb72ea2 in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1320 #15 0xeeb72ea2 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1421 #16 0xef3806ec in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:748 #17 0xef3806ec in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:984 #18 0xef2992f6 in link_program ../src/mesa/main/shaderapi.c:1336 #19 0xef2992f6 in link_program_error ../src/mesa/main/shaderapi.c:1445 Fixes: 40372bd ("panfrost: Implement a disk cache") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Boris Brezillon <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28743> (cherry picked from commit 4f5e9a2)
For instance, this issue is triggered with vs-to-fs-overlap.shader_test -auto -fbo: Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7fe64f58e9a7 in calloc (/usr/lib64/libasan.so.6+0xb19a7) waydroid#1 0x7fe642ca2839 in _mesa_symbol_table_ctor ../src/mesa/program/symbol_table.c:286 waydroid#2 0x7fe642ff003d in gl_nir_cross_validate_outputs_to_inputs ../src/compiler/glsl/gl_nir_link_varyings.c:728 waydroid#3 0x7fe642d7c7d8 in gl_nir_link_glsl ../src/compiler/glsl/gl_nir_linker.c:1357 waydroid#4 0x7fe642be6931 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:562 waydroid#5 0x7fe642be6931 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:944 waydroid#6 0x7fe642acab55 in link_program ../src/mesa/main/shaderapi.c:1336 waydroid#7 0x7fe642acab55 in link_program_error ../src/mesa/main/shaderapi.c:1447 waydroid#8 0x7fe6424aa389 in _mesa_unmarshal_LinkProgram src/mapi/glapi/gen/marshal_generated2.c:1911 waydroid#9 0x7fe641fd912b in glthread_unmarshal_batch ../src/mesa/main/glthread.c:139 waydroid#10 0x7fe641f48d48 in util_queue_thread_func ../src/util/u_queue.c:309 waydroid#11 0x7fe641fa442a in impl_thrd_routine ../src/c11/impl/threads_posix.c:67 Fixes: 7d1948e ("glsl: implement cross_validate_outputs_to_inputs() in nir linker") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27071> (cherry picked from commit bacace8)
Indeed, the object returned by LLVMCreatePassBuilderOptions() was not freed. For instance, this issue is triggered with "piglit/bin/cl-api-build-program": Direct leak of 32 byte(s) in 1 object(s) allocated from: #0 0x7f6b15abdf57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57) #1 0x7f6afff6529e in LLVMCreatePassBuilderOptions llvm-18.1.5/lib/Passes/PassBuilderBindings.cpp:83 #2 0x7f6b1186ee41 in optimize ../src/gallium/frontends/clover/llvm/invocation.cpp:521 #3 0x7f6b1186ee41 in clover::llvm::link_program(std::vector<clover::binary, std::allocator<clover::binary> > const&, clover::device const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) ../src/gallium/frontends/clover/llvm/invocation.cpp:554 #4 0x7f6b1150ce67 in link_program ../src/gallium/frontends/clover/core/compiler.hpp:78 #5 0x7f6b1150ce67 in clover::program::link(clover::ref_vector<clover::device> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, clover::ref_vector<clover::program> const&) ../src/gallium/frontends/clover/core/program.cpp:78 #6 0x7f6b11401a2b in clBuildProgram ../src/gallium/frontends/clover/api/program.cpp:283 Fixes: 2d4fe5f ("clover/llvm: move to modern pass manager.") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Karol Herbst <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29164> (cherry picked from commit df39994)
This change handles the case when "vertex_fetch_shader.cso" is null, it implements the previous behavior in this specific case. This situation is happening with clover. For instance, this issue is triggered with "piglit/bin/cl-custom-buffer-flags": ==6467==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000c (pc 0x7ff92908fe6e bp 0x7ffe86ae5ad0 sp 0x7ffe86ae5a30 T0) ==6467==The signal is caused by a READ memory access. ==6467==Hint: address points to the zero page. #0 0x7ff92908fe6e in evergreen_emit_vertex_buffers ../src/gallium/drivers/r600/evergreen_state.c:2123 #1 0x7ff92908444b in r600_emit_atom ../src/gallium/drivers/r600/r600_pipe.h:627 #2 0x7ff92908444b in compute_emit_cs ../src/gallium/drivers/r600/evergreen_compute.c:798 #3 0x7ff92908444b in evergreen_launch_grid ../src/gallium/drivers/r600/evergreen_compute.c:927 #4 0x7ff9349f9350 in clover::kernel::launch(clover::command_queue&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::vector<unsigned long, std::allocator<unsigned long> > const&) ../src/gallium/frontends/clover/core/kernel.cpp:105 #5 0x7ff9349c331d in std::function<void (clover::event&)>::operator()(clover::event&) const /usr/include/c++/11.4.0/bits/std_function.h:590 #6 0x7ff9349c331d in clover::event::trigger() ../src/gallium/frontends/clover/core/event.cpp:54 #7 0x7ff9349c82f1 in clover::hard_event::hard_event(clover::command_queue&, unsigned int, clover::ref_vector<clover::event> const&, std::function<void (clover::event&)>) ../src/gallium/frontends/clover/core/event.cpp:138 #8 0x7ff9348daa47 in create<clover::hard_event, clover::command_queue&, int, clover::ref_vector<clover::event>&, clEnqueueNDRangeKernel(cl_command_queue, cl_kernel, cl_uint, const size_t*, const size_t*, const size_t*, cl_uint, _cl_event* const*, _cl_event**)::<lambda(clover::event&)> > ../src/gallium/frontends/clover/util/pointer.hpp:241 #9 0x7ff9348daa47 in clEnqueueNDRangeKernel ../src/gallium/frontends/clover/api/kernel.cpp:334 Fixes: 659b7eb ("r600: better tracking for vertex buffer emission") Related: https://gitlab.freedesktop.org/mesa/mesa/-/issues/10079 Signed-off-by: Patrick Lerda <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/29163> (cherry picked from commit f8a1d9f)
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED. Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user doesn't call vkDestroyPipeline() for it so the descriptor sets referenced were never getting freed. Addresses: ``` Direct leak of 304 byte(s) in 1 object(s) allocated from: #0 0x7fa5a93ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26 waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48 waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56 waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc ../src/vulkan/runtime/vk_descriptor_set_layout.c:49 waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*, VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks const*, VkDescriptorSetLayout_T**) ../src/freedreno/vulkan/tu_descriptor_set.cc:161 ``` and ``` Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7f9b4b3ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105 waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:3898 waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:4203 waydroid#5 0x7f98b22588 in VkResult tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) ../src/freedreno/vulkan/tu_pipeline.cc:4234 ``` seen in: dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag Cc: mesa-stable Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188> (cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
This change ensures that all these allocations are using the same memory context. For instance, this issue is triggered with: "piglit/bin/arb_shader_image_load_store-host-mem-barrier -auto -fbo": Indirect leak of 32816 byte(s) in 1 object(s) allocated from: #0 0x7f49a35447ef in __interceptor_malloc (/usr/lib64/libasan.so.6+0xb17ef) waydroid#1 0x7f49998e4b4f in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7f49998e7521 in create_slab ../src/util/ralloc.c:801 waydroid#3 0x7f49998e7521 in gc_alloc_size ../src/util/ralloc.c:840 waydroid#4 0x7f49998e7d11 in gc_zalloc_size ../src/util/ralloc.c:868 waydroid#5 0x7f49999a6126 in nir_alu_instr_create ../src/compiler/nir/nir.c:682 waydroid#6 0x7f49999cba48 in clone_alu ../src/compiler/nir/nir_clone.c:217 waydroid#7 0x7f49999cc85a in clone_instr ../src/compiler/nir/nir_clone.c:456 waydroid#8 0x7f49999cee3a in clone_block ../src/compiler/nir/nir_clone.c:529 waydroid#9 0x7f49999cee3a in clone_cf_list ../src/compiler/nir/nir_clone.c:583 waydroid#10 0x7f49999d03be in clone_function_impl ../src/compiler/nir/nir_clone.c:660 waydroid#11 0x7f49999d13f7 in nir_function_impl_clone ../src/compiler/nir/nir_clone.c:678 #12 0x7f4999a0e2c5 in lower_call_function_impl ../src/compiler/nir/nir_functions.c:397 #13 0x7f4999a0e2c5 in function_link_pass ../src/compiler/nir/nir_functions.c:430 #14 0x7f4999a0e2c5 in function_link_pass ../src/compiler/nir/nir_functions.c:408 #15 0x7f4999a0e2c5 in nir_function_instructions_pass ../src/compiler/nir/nir_builder.h:108 #16 0x7f4999a0e2c5 in nir_link_shader_functions ../src/compiler/nir/nir_functions.c:452 #17 0x7f499ca30b8f in link_libintel_shaders ../src/gallium/drivers/iris/iris_program_cache.c:329 #18 0x7f499ca30b8f in iris_ensure_indirect_generation_shader ../src/gallium/drivers/iris/iris_program_cache.c:374 #19 0x7f499d185267 in gfx9_emit_indirect_generate ../src/gallium/drivers/iris/iris_indirect_gen.c:593 #20 0x7f499d119c79 in iris_upload_indirect_shader_render_state ../src/gallium/drivers/iris/iris_state.c:8744 #21 0x7f499fe86b01 in iris_indirect_draw_vbo ../src/gallium/drivers/iris/iris_draw.c:233 #22 0x7f499fe86b01 in iris_draw_vbo ../src/gallium/drivers/iris/iris_draw.c:343 #23 0x7f499a174e43 in tc_call_draw_indirect ../src/gallium/auxiliary/util/u_threaded_context.c:3828 #24 0x7f499a1557fe in batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:453 #25 0x7f499a1557fe in tc_batch_execute ../src/gallium/auxiliary/util/u_threaded_context.c:504 #26 0x7f499a167f26 in _tc_sync ../src/gallium/auxiliary/util/u_threaded_context.c:761 #27 0x7f499a168888 in tc_texture_map ../src/gallium/auxiliary/util/u_threaded_context.c:2783 #28 0x7f49986f2631 in pipe_texture_map ../src/gallium/auxiliary/util/u_inlines.h:556 #29 0x7f49986f2631 in _mesa_map_renderbuffer ../src/mesa/main/renderbuffer.c:494 #30 0x7f49991af7ca in readpixels_memcpy ../src/mesa/main/readpix.c:260 #31 0x7f49991af7ca in _mesa_readpixels ../src/mesa/main/readpix.c:898 #32 0x7f499931ee23 in st_ReadPixels ../src/mesa/state_tracker/st_cb_readpixels.c:575 #33 0x7f49991b40b5 in read_pixels ../src/mesa/main/readpix.c:1199 #34 0x7f49991b40b5 in _mesa_ReadnPixelsARB ../src/mesa/main/readpix.c:1216 #35 0x7f49991b4a20 in _mesa_ReadPixels ../src/mesa/main/readpix.c:1231 ... SUMMARY: AddressSanitizer: 323648 byte(s) leaked in 201 allocation(s). Fixes: 5438b19 ("iris: enable generated indirect draws") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Lionel Landwerlin <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31313> (cherry picked from commit b6b363c)
For instance, this issue is triggered with "piglit/bin/glsl-fs-loop -auto -fbo": Indirect leak of 120 byte(s) in 5 object(s) allocated from: #0 0x7f8e7930ef57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57) waydroid#1 0x7f8e6dc8c68a in __gnu_cxx::new_allocator<std::_List_node<nir_intrinsic_instr*> >::allocate(unsigned long, void const*) /usr/include/c++/11.4.0/ext/new_allocator.h:127 waydroid#2 0x7f8e6dc8c68a in std::allocator_traits<std::allocator<std::_List_node<nir_intrinsic_instr*> > >::allocate(std::allocator<std::_List_node<nir_intrinsic_instr*> >&, unsigned long) /usr/include/c++/11.4.0/bits/alloc_traits.h:464 waydroid#3 0x7f8e6dc8c68a in std::__cxx11::_List_base<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_get_node() /usr/include/c++/11.4.0/bits/stl_list.h:443 waydroid#4 0x7f8e6dc8c68a in std::_List_node<nir_intrinsic_instr*>* std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_create_node<nir_intrinsic_instr* const&>(nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:635 waydroid#5 0x7f8e6dc8c68a in void std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::_M_insert<nir_intrinsic_instr* const&>(std::_List_iterator<nir_intrinsic_instr*>, nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:1912 waydroid#6 0x7f8e6dc8c68a in std::__cxx11::list<nir_intrinsic_instr*, std::allocator<nir_intrinsic_instr*> >::push_back(nir_intrinsic_instr* const&) /usr/include/c++/11.4.0/bits/stl_list.h:1213 waydroid#7 0x7f8e6dc8c68a in r600::Shader::scan_instruction(nir_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:655 waydroid#8 0x7f8e6dc8cc2a in r600::Shader::scan_shader(nir_function const*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:554 waydroid#9 0x7f8e6dcab5bc in r600::Shader::process(nir_shader*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:526 waydroid#10 0x7f8e6dcabae1 in r600::Shader::translate_from_nir(nir_shader*, pipe_stream_output_info const*, r600_shader*, r600_shader_key const&, r600_chip_class, radeon_family) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:494 waydroid#11 0x7f8e6da5bf15 in r600_shader_from_nir ../src/gallium/drivers/r600/r600_sfn.cpp:111 #12 0x7f8e6da5db2c in r600_pipe_shader_create ../src/gallium/drivers/r600/r600_shader.c:198 #13 0x7f8e6da95c62 in r600_shader_select ../src/gallium/drivers/r600/r600_state_common.c:961 #14 0x7f8e6da9c09f in r600_update_derived_state ../src/gallium/drivers/r600/r600_state_common.c:1888 #15 0x7f8e6da9c09f in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2219 #16 0x7f8e6d55229d in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1782 #17 0x7f8e6c5d6322 in _mesa_draw_arrays ../src/mesa/main/draw.c:1204 Fixes: 5de8141 ("r600/sfn: Allow skipping backend shader optimization for a subset of shaders") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Gert Wollny <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27334> (cherry picked from commit b660c73)
For instance, this issue is triggered with "piglit/bin/glsl-vs-arrays -auto -fbo": Direct leak of 104 byte(s) in 1 object(s) allocated from: #0 0x7f2fab415f57 in operator new(unsigned long) (/usr/lib64/libasan.so.6+0xb2f57) waydroid#1 0x7f2f9fd9d541 in __gnu_cxx::new_allocator<std::__detail::_Hash_node_base*>::allocate(unsigned long, void const*) /usr/include/c++/11.4.0/ext/new_allocator.h:127 waydroid#2 0x7f2f9fd9d541 in std::allocator_traits<std::allocator<std::__detail::_Hash_node_base*> >::allocate(std::allocator<std::__detail::_Hash_node_base*>&, unsigned long) /usr/include/c++/11.4.0/bits/alloc_traits.h:464 waydroid#3 0x7f2f9fd9d541 in std::__detail::_Hashtable_alloc<std::allocator<std::__detail::_Hash_node<std::pair<int const, r600::Instr*>, false> > >::_M_allocate_buckets(unsigned long) /usr/include/c++/11.4.0/bits/hashtable_policy.h:1927 waydroid#4 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_allocate_buckets(unsigned long) /usr/include/c++/11.4.0/bits/hashtable.h:440 waydroid#5 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_rehash_aux(unsigned long, std::integral_constant<bool, true>) /usr/include/c++/11.4.0/bits/hashtable.h:2382 waydroid#6 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_rehash(unsigned long, unsigned long const&) /usr/include/c++/11.4.0/bits/hashtable.h:2361 waydroid#7 0x7f2f9fd9d541 in std::_Hashtable<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_insert_unique_node(unsigned long, unsigned long, std::__detail::_Hash_node<std::pair<int const, r600::Instr*>, false>*, unsigned long) /usr/include/c++/11.4.0/bits/hashtable.h:2021 waydroid#8 0x7f2f9fd9e7f8 in std::__detail::_Map_base<int, std::pair<int const, r600::Instr*>, std::allocator<std::pair<int const, r600::Instr*> >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true>, true>::operator[](int&&) /usr/include/c++/11.4.0/bits/hashtable_policy.h:741 waydroid#9 0x7f2f9fd9f6fe in std::unordered_map<int, r600::Instr*, std::hash<int>, std::equal_to<int>, std::allocator<std::pair<int const, r600::Instr*> > >::operator[](int&&) /usr/include/c++/11.4.0/bits/unordered_map.h:984 waydroid#10 0x7f2f9fd9f6fe in r600::Shader::InstructionChain::visit(r600::AluInstr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1358 waydroid#11 0x7f2f9fd8f309 in r600::Shader::emit_instruction(r600::Instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1419 #12 0x7f2f9fd8f822 in r600::RegisterReadHandler::visit(r600::LocalArray&) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:1040 #13 0x7f2f9fd8e726 in r600::Shader::emit_load_reg_indirect(nir_intrinsic_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:993 #14 0x7f2f9fd8de5c in r600::Shader::process_instr(nir_instr*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:848 #15 0x7f2f9fd8de5c in r600::Shader::process_block(nir_block*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:836 #16 0x7f2f9fd962f2 in r600::Shader::process_cf_node(nir_cf_node*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:669 #17 0x7f2f9fdac01a in r600::Shader::process(nir_shader*) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:537 #18 0x7f2f9fdac3d1 in r600::Shader::translate_from_nir(nir_shader*, pipe_stream_output_info const*, r600_shader*, r600_shader_key const&, r600_chip_class, radeon_family) ../src/gallium/drivers/r600/sfn/sfn_shader.cpp:494 #19 0x7f2f9fb5c8f5 in r600_shader_from_nir ../src/gallium/drivers/r600/r600_sfn.cpp:111 #20 0x7f2f9fb5e50c in r600_pipe_shader_create ../src/gallium/drivers/r600/r600_shader.c:198 #21 0x7f2f9fb96642 in r600_shader_select ../src/gallium/drivers/r600/r600_state_common.c:961 #22 0x7f2f9fb97340 in r600_create_shader_state ../src/gallium/drivers/r600/r600_state_common.c:1056 #23 0x7f2f9e060f82 in st_create_common_variant ../src/mesa/state_tracker/st_program.c:720 #24 0x7f2f9e06e779 in st_get_common_variant ../src/mesa/state_tracker/st_program.c:773 #25 0x7f2f9e06f78d in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1259 #26 0x7f2f9e06f78d in st_finalize_program ../src/mesa/state_tracker/st_program.c:1345 #27 0x7f2f9ead0f20 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:723 #28 0x7f2f9ead0f20 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:951 #29 0x7f2f9e9b0d15 in link_program ../src/mesa/main/shaderapi.c:1336 #30 0x7f2f9e9b0d15 in link_program_error ../src/mesa/main/shaderapi.c:1447 Fixes: ddb167e ("r600/sfn: Handle indirect array load/store dependencies better") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Gert Wollny <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27334> (cherry picked from commit 242da61)
Addresses: ``` Direct leak of 192 byte(s) in 1 object(s) allocated from: #0 0x7fbe5e4230 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164 waydroid#1 0x7fbd008bf4 in vk_default_realloc ../src/vulkan/util/vk_alloc.c:37 waydroid#2 0x7fbbabb2fc in vk_realloc ../src/vulkan/util/vk_alloc.h:70 waydroid#3 0x7fbbaead38 in tu_push_descriptor_set_update_layout ../src/freedreno/vulkan/tu_cmd_buffer.cc:3173 waydroid#4 0x7fbbaeb0b4 in tu_push_descriptor_set ../src/freedreno/vulkan/tu_cmd_buffer.cc:3203 waydroid#5 0x7fbbaeb500 in tu_CmdPushDescriptorSet2KHR(VkCommandBuffer_T*, VkPushDescriptorSetInfoKHR const*) ../src/freedreno/vulkan/tu_cmd_buffer.cc:3235 waydroid#6 0x7fbbe35c80 in vk_common_CmdPushDescriptorSetKHR ../src/vulkan/runtime/vk_command_buffer.c:300 ``` seen in: dEQP-VK.binding_model.shader_access.secondary_cmd_buf.bind.with_push.sampler_mutable.tess_eval.multiple_discontiguous_descriptors.1d_array Fixes: 03294e1 ("turnip: Keep a host copy of push descriptor sets.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit 53c2d5e426d8a5b919ea3c64bad9e46b354b2fc9)
We can end up calling vk_multialloc_alloc with 0 size when `attachment_count` is 0 and `clearValueCount` is 0. Addressed: ``` Direct leak of 1 byte(s) in 1 object(s) allocated from: #0 0x7faf033ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fada5cc10 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26 waydroid#2 0x7fac50b270 in vk_alloc ../src/vulkan/util/vk_alloc.h:48 waydroid#3 0x7fac555040 in vk_multialloc_alloc ../src/vulkan/util/vk_alloc.h:234 waydroid#4 0x7fac555040 in void tu_CmdBeginRenderPass2<(chip)7>(VkCommandBuffer_T*, VkRenderPassBeginInfo const*, VkSubpassBeginInfo const*) ../src/freedreno/vulkan/tu_cmd_buffer.cc:4634 waydroid#5 0x7fac900760 in vk_common_CmdBeginRenderPass ../src/vulkan/runtime/vk_render_pass.c:261 ``` seen in: dEQP-VK.robustness.robustness2.bind.notemplate.r32i.dontunroll.nonvolatile.uniform_texel_buffer.no_fmt_qual.len_252.samples_1.1d.frag Fixes: 4cfd021 ("turnip: Save the renderpass's clear values in the cmdbuf state.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit c923eff742b83cc475d02ad57c538754db991c06)
Addresses: ``` Indirect leak of 256 byte(s) in 2 object(s) allocated from: #0 0x7faaf53ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fa8cfe900 in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7fa8cfeb20 in rzalloc_size ../src/util/ralloc.c:152 waydroid#3 0x7fa8cff004 in rzalloc_array_size ../src/util/ralloc.c:232 waydroid#4 0x7fa8d06a84 in _mesa_set_init ../src/util/set.c:133 waydroid#5 0x7fa8d06bcc in _mesa_set_create ../src/util/set.c:152 waydroid#6 0x7fa8d0939c in _mesa_pointer_set_create ../src/util/set.c:613 waydroid#7 0x7fa95e5790 in nir_lower_mediump_vars ../src/compiler/nir/nir_lower_mediump.c:574 waydroid#8 0x7fa862c1c8 in tu_spirv_to_nir(tu_device*, void*, unsigned long, VkPipelineShaderStageCreateInfo const*, tu_shader_key const*, pipe_shader_type) ../src/freedreno/vulkan/tu_shader.cc:116 waydroid#9 0x7fa8646f24 in tu_compile_shaders(tu_device*, unsigned long, VkPipelineShaderStageCreateInfo const**, nir_shader**, tu_shader_key const*, tu_pipeline_layout*, unsigned char const*, tu_shader**, char**, void*, nir_shader**, VkPipelineCreationFeedback*) ../src/freedreno/vulkan/tu_shader.cc:2741 waydroid#10 0x7fa85a16a4 in tu_pipeline_builder_compile_shaders ../src/freedreno/vulkan/tu_pipeline.cc:1887 waydroid#11 0x7fa85eb844 in tu_pipeline_builder_build<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:3923 #12 0x7fa85e6bd8 in tu_graphics_pipeline_create<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:4203 #13 0x7fa85c2588 in VkResult tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) ../src/freedreno/vulkan/tu_pipeline.cc:4234 ``` seen in: dEQP-VK.binding_model.mutable_descriptor.single.switches.uniform_texel_buffer_storage_image.update_write.no_source.no_source.pool_expand_types.pre_update.no_array.vert Fixes: 7e986e5 ("nir/lower_mediump_vars: Don't lower mediump shared vars with atomic access.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit 2a7df331af65216e0229fe6481c1eca70221b225)
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED. Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user doesn't call vkDestroyPipeline() for it so the descriptor sets referenced were never getting freed. Addresses: ``` Direct leak of 304 byte(s) in 1 object(s) allocated from: #0 0x7fa5a93ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26 waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48 waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56 waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc ../src/vulkan/runtime/vk_descriptor_set_layout.c:49 waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*, VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks const*, VkDescriptorSetLayout_T**) ../src/freedreno/vulkan/tu_descriptor_set.cc:161 ``` and ``` Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7f9b4b3ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105 waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:3898 waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:4203 waydroid#5 0x7f98b22588 in VkResult tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) ../src/freedreno/vulkan/tu_pipeline.cc:4234 ``` seen in: dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag Cc: mesa-stable Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188> (cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
Addresses: ``` Direct leak of 192 byte(s) in 1 object(s) allocated from: #0 0x7fbe5e4230 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164 waydroid#1 0x7fbd008bf4 in vk_default_realloc ../src/vulkan/util/vk_alloc.c:37 waydroid#2 0x7fbbabb2fc in vk_realloc ../src/vulkan/util/vk_alloc.h:70 waydroid#3 0x7fbbaead38 in tu_push_descriptor_set_update_layout ../src/freedreno/vulkan/tu_cmd_buffer.cc:3173 waydroid#4 0x7fbbaeb0b4 in tu_push_descriptor_set ../src/freedreno/vulkan/tu_cmd_buffer.cc:3203 waydroid#5 0x7fbbaeb500 in tu_CmdPushDescriptorSet2KHR(VkCommandBuffer_T*, VkPushDescriptorSetInfoKHR const*) ../src/freedreno/vulkan/tu_cmd_buffer.cc:3235 waydroid#6 0x7fbbe35c80 in vk_common_CmdPushDescriptorSetKHR ../src/vulkan/runtime/vk_command_buffer.c:300 ``` seen in: dEQP-VK.binding_model.shader_access.secondary_cmd_buf.bind.with_push.sampler_mutable.tess_eval.multiple_discontiguous_descriptors.1d_array Fixes: 03294e1 ("turnip: Keep a host copy of push descriptor sets.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit 53c2d5e426d8a5b919ea3c64bad9e46b354b2fc9)
We can end up calling vk_multialloc_alloc with 0 size when `attachment_count` is 0 and `clearValueCount` is 0. Addressed: ``` Direct leak of 1 byte(s) in 1 object(s) allocated from: #0 0x7faf033ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fada5cc10 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26 waydroid#2 0x7fac50b270 in vk_alloc ../src/vulkan/util/vk_alloc.h:48 waydroid#3 0x7fac555040 in vk_multialloc_alloc ../src/vulkan/util/vk_alloc.h:234 waydroid#4 0x7fac555040 in void tu_CmdBeginRenderPass2<(chip)7>(VkCommandBuffer_T*, VkRenderPassBeginInfo const*, VkSubpassBeginInfo const*) ../src/freedreno/vulkan/tu_cmd_buffer.cc:4634 waydroid#5 0x7fac900760 in vk_common_CmdBeginRenderPass ../src/vulkan/runtime/vk_render_pass.c:261 ``` seen in: dEQP-VK.robustness.robustness2.bind.notemplate.r32i.dontunroll.nonvolatile.uniform_texel_buffer.no_fmt_qual.len_252.samples_1.1d.frag Fixes: 4cfd021 ("turnip: Save the renderpass's clear values in the cmdbuf state.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit c923eff742b83cc475d02ad57c538754db991c06)
Addresses: ``` Indirect leak of 256 byte(s) in 2 object(s) allocated from: #0 0x7faaf53ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fa8cfe900 in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7fa8cfeb20 in rzalloc_size ../src/util/ralloc.c:152 waydroid#3 0x7fa8cff004 in rzalloc_array_size ../src/util/ralloc.c:232 waydroid#4 0x7fa8d06a84 in _mesa_set_init ../src/util/set.c:133 waydroid#5 0x7fa8d06bcc in _mesa_set_create ../src/util/set.c:152 waydroid#6 0x7fa8d0939c in _mesa_pointer_set_create ../src/util/set.c:613 waydroid#7 0x7fa95e5790 in nir_lower_mediump_vars ../src/compiler/nir/nir_lower_mediump.c:574 waydroid#8 0x7fa862c1c8 in tu_spirv_to_nir(tu_device*, void*, unsigned long, VkPipelineShaderStageCreateInfo const*, tu_shader_key const*, pipe_shader_type) ../src/freedreno/vulkan/tu_shader.cc:116 waydroid#9 0x7fa8646f24 in tu_compile_shaders(tu_device*, unsigned long, VkPipelineShaderStageCreateInfo const**, nir_shader**, tu_shader_key const*, tu_pipeline_layout*, unsigned char const*, tu_shader**, char**, void*, nir_shader**, VkPipelineCreationFeedback*) ../src/freedreno/vulkan/tu_shader.cc:2741 waydroid#10 0x7fa85a16a4 in tu_pipeline_builder_compile_shaders ../src/freedreno/vulkan/tu_pipeline.cc:1887 waydroid#11 0x7fa85eb844 in tu_pipeline_builder_build<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:3923 #12 0x7fa85e6bd8 in tu_graphics_pipeline_create<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:4203 #13 0x7fa85c2588 in VkResult tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) ../src/freedreno/vulkan/tu_pipeline.cc:4234 ``` seen in: dEQP-VK.binding_model.mutable_descriptor.single.switches.uniform_texel_buffer_storage_image.update_write.no_source.no_source.pool_expand_types.pre_update.no_array.vert Fixes: 7e986e5 ("nir/lower_mediump_vars: Don't lower mediump shared vars with atomic access.") Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057> (cherry picked from commit 2a7df331af65216e0229fe6481c1eca70221b225)
For a TU_PIPELINE_GRAPHICS_LIB we were taking a ref to the descriptor set layout but never releasing on VK_PIPELINE_COMPILE_REQUIRED. Since VK_PIPELINE_COMPILE_REQUIRED is technically an error, the user doesn't call vkDestroyPipeline() for it so the descriptor sets referenced were never getting freed. Addresses: ``` Direct leak of 304 byte(s) in 1 object(s) allocated from: #0 0x7fa5a93ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7fa44bac84 in vk_default_alloc ../src/vulkan/util/vk_alloc.c:26 waydroid#2 0x7fa32ea5d8 in vk_alloc ../src/vulkan/util/vk_alloc.h:48 waydroid#3 0x7fa32ea60c in vk_zalloc ../src/vulkan/util/vk_alloc.h:56 waydroid#4 0x7fa32ea750 in vk_descriptor_set_layout_zalloc ../src/vulkan/runtime/vk_descriptor_set_layout.c:49 waydroid#5 0x7fa306fc98 in tu_CreateDescriptorSetLayout(VkDevice_T*, VkDescriptorSetLayoutCreateInfo const*, VkAllocationCallbacks const*, VkDescriptorSetLayout_T**) ../src/freedreno/vulkan/tu_descriptor_set.cc:161 ``` and ``` Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7f9b4b3ee0 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 waydroid#1 0x7f9925e900 in ralloc_size ../src/util/ralloc.c:118 waydroid#2 0x7f9925e8d4 in ralloc_context ../src/util/ralloc.c:105 waydroid#3 0x7f98b4b214 in tu_pipeline_builder_build<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:3898 waydroid#4 0x7f98b46bd8 in tu_graphics_pipeline_create<(chip)7> ../src/freedreno/vulkan/tu_pipeline.cc:4203 waydroid#5 0x7f98b22588 in VkResult tu_CreateGraphicsPipelines<(chip)7>(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) ../src/freedreno/vulkan/tu_pipeline.cc:4234 ``` seen in: dEQP-VK.pipeline.pipeline_library.shader_module_identifier.pipeline_from_id.graphics.4_variants.no_spec_constants.no_pipeline_cache.all_zeros_id.no_exec_properties.vert_tesc_tese_frag Cc: mesa-stable Signed-off-by: Karmjit Mahil <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32188> (cherry picked from commit 21baf2f6c1f829f7d09162d123fa726f52e800f1)
Hello, opening an issue here to continue the discussion from
waydroid/android_hardware_waydroid#44
Let me recap the context:
I'm working on enabling camera support for Waydroid on a PinephonePro which use an RK3399 SoC.
The RK3399 camera subsystem produces images in NV12 format (only partially supports other formats, NV12 is strongly preferred).
As per Android design, the Camera HAL and the gralloc HAL implementation should agree on what format HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED has to be mapped to (see the above mentioned merge request).
The gralloc_gbm backend does the allocation using libgbm, which is provided by mesa on Waydroid and which as of today doesn't support NV12.
I investigated with upstream #dri-devel last week about this, and what I've been told is that NV12 support is not in upstream mesa because nobody actually used that, and I've been reminded that the 'g' in 'gbm' stands for 'graphic' and not 'generic' so it is probably possible to add NV12 support to mesa, but it's not that anyone really cares as RGB formats are way more common.
So here's my question(s)
https://github.com/waydroid/android_hardware_waydroid/blob/lineage-18.1/gralloc/gralloc_gbm.cpp#L100
which makes me think support for some kind of YUV format was needed and it has been implemented by mapping it on what's available on mesa today, with a few hacks here and there to have it working
https://github.com/waydroid/android_hardware_waydroid/blob/lineage-18.1/gralloc/gralloc_gbm.cpp#L194
This commit actually puzzles me as well waydroid/android_hardware_waydroid@0876013
as I don't see any "mapping" there, as a value of "0" doesn't seem a valid GBM_FORMAT value.
https://github.com/waydroid/android_external_minigbm/blob/lineage-18.1/rockchip.c#L173
Yes, it requires out-of-tree kernel support at the moment. The reasons why that ioctl is not in the rockchip upstream DRM driver are not fully clear to me yet.
In a case like this, where using minigbm seems more appropriate for the device at hand, would it be possible to instrument the Waydroid build to pick minigbm instead of mesa as libgbm provider ?
All in all, with the current gralloc+mesa implementation, camera support using NV12 format doesn't seem possible to me...
The text was updated successfully, but these errors were encountered: