Venus: destroy the device's object mutex after the objects that lock it

Bionic aborts on locking a destroyed mutex ("pthread_mutex_lock called on a destroyed mutex",
Tab S9 FE G68, Pixel 9a), so a client that exited holding objects took the render worker down.
From BattleTempest's DroidDeck-Pixel (kevinbryant551-ux/DroidDeck-Pixel, GPL-3.0).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
The412BannerandClaude Opus 5.5 committed 2026-10-19 09:08:37 +00:00
1 parent 8e8c27be95
commit 93038b7d9d
2 files changed
+31

No files matched your search

+1
View File
@@ -79,6 +79,7 @@ git clone -q --depth 1 -b v1.4.365 https://github.com/KhronosGroup/Vulkan-Header
git clone -q --depth 1 -b virglrenderer-1.3.0 https://gitlab.freedesktop.org/virgl/virglrenderer.git
git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-android.patch"
git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-destroy-unknown-pipeline.patch"
git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-destroy-mutex-after-objects.patch"
cat > compat/log/log.h <<'EOC'
#pragma once
#include <android/log.h>
@@ -0,0 +1,30 @@
venus: destroy a device's object mutex after the objects that lock it
From BattleTempest's DroidDeck-Pixel (kevinbryant551-ux/DroidDeck-Pixel, GPL-3.0),
tools/venus/patches/0103-destroy-object-mutex-after-objects.patch. Bionic aborts on locking a
destroyed mutex ("pthread_mutex_lock called on a destroyed mutex", seen on a Tab S9 FE G68
and a Pixel 9a), so a client that exited holding objects took the render worker down.
diff --git a/src/venus/vkr_device.c b/src/venus/vkr_device.c
index 9144180..7b7c904 100644
--- a/src/venus/vkr_device.c
+++ b/src/venus/vkr_device.c
@@ -324,13 +324,16 @@ vkr_device_destroy(struct vkr_context *ctx, struct vkr_device *dev, bool destroy
vkr_log("vkDeviceWaitIdle(%p) failed(%d)", dev, (int32_t)result);
}
- mtx_destroy(&dev->object_mutex);
-
+ /* The leftover objects are removed under object_mutex: destroy it after them. glibc lets a
+ * destroyed mutex be locked; bionic aborts ("pthread_mutex_lock called on a destroyed mutex"),
+ * so every client that exited holding objects took its render worker down. */
if (!list_is_empty(&dev->objects)) {
list_for_each_entry_safe (struct vkr_object, obj, &dev->objects, track_head)
vkr_device_object_destroy(ctx, dev, obj);
}
+ mtx_destroy(&dev->object_mutex);
+
list_for_each_entry_safe (struct vkr_queue, queue, &dev->queues, base.track_head)
vkr_queue_destroy(ctx, queue);