turnip: Remove failed command buffer from pool

When an error condition occurs during tu_create_cmd_buffer(), the
cmd buffer has already been added to a pool, so the cleanup code should
remove it.

Fixes a crash (assert in tu_device::tu_bo_finish()) in dEQP tests:

dEQP-VK.api.object_management.max_concurrent.command_buffer_primary
dEQP-VK.api.object_management.max_concurrent.command_buffer_secondary

due to pool attempting to destroy an invalid command buffer.

Reviewed-by: Kristian H. Kristensen <hoegsberg@google.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3572>

diff --git a/src/freedreno/vulkan/tu_cmd_buffer.c b/src/freedreno/vulkan/tu_cmd_buffer.c
index 7dc83c5356bdc8bcbbcafb777c464e56c72ecc7d..4cb47cef94646dba85e7c70354b8ef612ad169a8 100644 (file)
--- a/src/freedreno/vulkan/tu_cmd_buffer.c
+++ b/src/freedreno/vulkan/tu_cmd_buffer.c
@@ -1667,7 +1667,7 @@ tu_create_cmd_buffer(struct tu_device *device,
 
    VkResult result = tu_bo_init_new(device, &cmd_buffer->scratch_bo, 0x1000);
    if (result != VK_SUCCESS)
-      return result;
+      goto fail_scratch_bo;
 
 #define VSC_DATA_SIZE(pitch)  ((pitch) * 32 + 0x100)  /* extra size to store VSC_SIZE */
 #define VSC_DATA2_SIZE(pitch) ((pitch) * 32)
@@ -1690,6 +1690,8 @@ fail_vsc_data2:
    tu_bo_finish(cmd_buffer->device, &cmd_buffer->vsc_data);
 fail_vsc_data:
    tu_bo_finish(cmd_buffer->device, &cmd_buffer->scratch_bo);
+fail_scratch_bo:
+   list_del(&cmd_buffer->pool_link);
    return result;
 }