From 0a0fb7cbc63d66977c148c3f5fd86de8e879f1ab Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Mon, 22 Aug 2022 20:10:46 +0200 Subject: [PATCH] gallium/u_threaded: add missing reference counts for draw_multi slots MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a glMultiDrawElementsEXT() call doesn't fit into a single slot, the same pipe_resource pointer is copied into all following slots, the completion of each will decrement the reference counter; however, it was never incremented for all but the first slot. This fixes a use-after-free bug with glMultiDrawElementsEXT(). Cc: mesa-stable Reviewed-by: Marek Olšák Reviewed-By: Mike Blumenkrantz Part-of: --- src/gallium/auxiliary/util/u_threaded_context.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/gallium/auxiliary/util/u_threaded_context.c b/src/gallium/auxiliary/util/u_threaded_context.c index fcd65afdcf7..b4a2e372cdd 100644 --- a/src/gallium/auxiliary/util/u_threaded_context.c +++ b/src/gallium/auxiliary/util/u_threaded_context.c @@ -3517,7 +3517,14 @@ tc_draw_vbo(struct pipe_context *_pipe, const struct pipe_draw_info *info, tc_add_slot_based_call(tc, TC_CALL_draw_multi, tc_draw_multi, dr); memcpy(&p->info, info, DRAW_INFO_SIZE_WITHOUT_INDEXBUF_AND_MIN_MAX_INDEX); - p->info.index.resource = buffer; + + if (total_offset == 0) + /* the first slot inherits the reference from u_upload_alloc() */ + p->info.index.resource = buffer; + else + /* all following slots need a new reference */ + tc_set_resource_reference(&p->info.index.resource, buffer); + p->num_draws = dr; /* Upload index buffers. */