fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-26 20:50:23 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

tu: Fix use-after-free in device destruction on old kernels

Browse source 
tu_bo_make_zombie() accesses the queue.

Fixes: f6c7f16322 ("tu: Implement VK_EXT_multisampled_render_to_single_sampled")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39113>
This commit is contained in:
Emma Anholt 2025-12-30 16:40:49 -08:00 • committed by Marge Bot
parent 2e78d6edf1
commit 2878b86ccf
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/freedreno/vulkan/tu_device.cc
View file

@ -3183,6 +3183,11 @@ tu_DestroyDevice(VkDevice _device, const VkAllocationCallbacks *pAllocator)
vk_free(&device->vk.alloc, device->trace_suballoc);
}
if (device->msrtss_color_temporary)
tu_destroy_memory(device, device->msrtss_color_temporary);
if (device->msrtss_depth_temporary)
tu_destroy_memory(device, device->msrtss_depth_temporary);
for (unsigned i = 0; i < TU_MAX_QUEUE_FAMILIES; i++) {
for (unsigned q = 0; q < device->queue_count[i]; q++)
tu_queue_finish(&device->queues[i][q]);
@ -3190,11 +3195,6 @@ tu_DestroyDevice(VkDevice _device, const VkAllocationCallbacks *pAllocator)
vk_free(&device->vk.alloc, device->queues[i]);
}
if (device->msrtss_color_temporary)
tu_destroy_memory(device, device->msrtss_color_temporary);
if (device->msrtss_depth_temporary)
tu_destroy_memory(device, device->msrtss_depth_temporary);
tu_drm_device_finish(device);
if (device->physical_device->has_set_iova)