minigbm: unmap right before buffer destruction
Regardless of the allocator, we want to make sure any mappings
we create are eventually freed. This patch adds logic to
drv_bo_destroy to free any mappings before the GEM close
ioctl is called.
BUG=chromium:764871
TEST=gbmtest, mmap_test -g on eve
Change-Id: I8f4edb4bc01ff6e1d71a60e0309e77e9fc3840f4
Reviewed-on: https://chromium-review.googlesource.com/441916
Commit-Ready: Gurchetan Singh <gurchetansingh@chromium.org>
Tested-by: Gurchetan Singh <gurchetansingh@chromium.org>
Reviewed-by: Joe Kniss <djmk@google.com>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
diff --git a/drv.c b/drv.c
index ff99893..b43b771 100644
--- a/drv.c
+++ b/drv.c
@@ -305,7 +305,6 @@
{
size_t plane;
uintptr_t total = 0;
- size_t map_count = 0;
struct driver *drv = bo->drv;
pthread_mutex_lock(&drv->driver_lock);
@@ -313,22 +312,13 @@
for (plane = 0; plane < bo->num_planes; plane++)
drv_decrement_reference_count(drv, bo, plane);
- for (plane = 0; plane < bo->num_planes; plane++) {
- void *ptr;
-
+ for (plane = 0; plane < bo->num_planes; plane++)
total += drv_get_reference_count(drv, bo, plane);
- map_count += !drmHashLookup(bo->drv->map_table, bo->handles[plane].u32, &ptr);
- }
pthread_mutex_unlock(&drv->driver_lock);
if (total == 0) {
- /*
- * If we leak a reference to the GEM handle being freed here in the mapping table,
- * we risk using the mapping table entry later for a completely different BO that
- * gets the same handle. (See b/38250067.)
- */
- assert(!map_count);
+ assert(drv_map_info_destroy(bo) == 0);
bo->drv->backend->bo_destroy(bo);
}