@@ -582,6 +582,31 @@ static void test_sync_multi_producer_single_consumer(void)
pthread_join(threads[i], NULL);
}
+static void test_sync_expired_merge(void)
+{
+ int iterations = 1 << 20;
+ int timeline;
+ int i;
+ int fence_expired, fence_merged;
+
+ timeline = sw_sync_timeline_create();
+
+ sw_sync_timeline_inc(timeline, 100);
+ fence_expired = sw_sync_fence_create(timeline, 1);
+ fence_merged = sw_sync_merge(fence_expired, fence_expired);
+ sw_sync_fence_destroy(fence_merged);
+
+ for (i = 0; i < iterations; i++) {
+ int fence = sw_sync_merge(fence_expired, fence_expired);
+
+ igt_assert_f(sw_sync_wait(fence, -1) > 0,
+ "Failure waiting on fence\n");
+ sw_sync_fence_destroy(fence);
+ }
+
+ sw_sync_fence_destroy(fence_expired);
+}
+
static void test_sync_random_merge(void)
{
int i, size, ret;
@@ -687,6 +712,9 @@ igt_main
igt_subtest("sync_multi_producer_single_consumer")
test_sync_multi_producer_single_consumer();
+ igt_subtest("sync_expired_merge")
+ test_sync_expired_merge();
+
igt_subtest("sync_random_merge")
test_sync_random_merge();
}
This test creates an already expired fence, then creates a merged fence out of that expired one (passed twice to the merge operation), and finally closes the merged fence. It shows that if the refcounts are wrong on the original expired fence, it might get freed while still in use. Usually a kernel panick will follow. Signed-off-by: Rafael Antognolli <rafael.antognolli@intel.com> --- tests/sw_sync.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)