virgl: Avoid a race condition on handle removal

We were unlocking the bo handles hash table right after removing the bo handle
and afterward closing it. This leads to race conditions where the handle could
have been re-acquired on another thread. As the kernel would return the same
bo handle and do not reference count them, this leads to it being used after
being closed.

Signed-off-by: Corentin Noël <corentin.noel@collabora.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
cc: mesa-stable

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31421>

src/gallium/winsys/virgl/drm/virgl_drm_winsys.c

@@ -93,13 +93,17 @@ static void virgl_hw_res_destroy(struct virgl_drm_winsys *qdws,
       if (res->flink_name)
          _mesa_hash_table_remove_key(qdws->bo_names,
                                 (void *)(uintptr_t)res->flink_name);
-      mtx_unlock(&qdws->bo_handles_mutex);
       if (res->ptr)
          os_munmap(res->ptr, res->size);
 
       memset(&args, 0, sizeof(args));
       args.handle = res->bo_handle;
       drmIoctl(qdws->fd, DRM_IOCTL_GEM_CLOSE, &args);
+      /* We need to unlock the access to bo_handles after closing the GEM to
+       * avoid a race condition where another thread would not find the
+       * bo_handle leading to a call of DRM_IOCTL_GEM_OPEN which will return
+       * the same bo_handle as the one we are closing here. */
+      mtx_unlock(&qdws->bo_handles_mutex);
       FREE(res);
 }