fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-08 13:28:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

gallium: fix surface->destroy use-after-free

Browse source 
regen surface on every update framebuffer

Cc: mesa-stable@lists.freedesktop.org

Reviewed-by: Marek Olšák <marek.olsak@amd.com>

Signed-off-by: liuyujun <liuyujun@uniontech.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/12520>
This commit is contained in:
liuyujun 2021-08-24 20:34:14 +08:00 • committed by Marge Bot
parent 838c0e5eef
commit 2bdc0bb324
3 changed files with 34 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/mesa/state_tracker/st_atom_framebuffer.c
View file

@ -152,6 +152,9 @@ st_update_framebuffer_state( struct st_context *st )
}
if (strb->surface) {
if (strb->surface->context != st->pipe) {
st_regen_renderbuffer_surface(st, strb);
}
framebuffer.cbufs[i] = strb->surface;
update_framebuffer_size(&framebuffer, strb->surface);
}
@ -181,6 +184,9 @@ st_update_framebuffer_state( struct st_context *st )
/* rendering to a GL texture, may have to update surface */
st_update_renderbuffer_surface(st, strb);
}
if (strb->surface && strb->surface->context != st->pipe) {
st_regen_renderbuffer_surface(st, strb);
}
framebuffer.zsbuf = strb->surface;
if (strb->surface)
update_framebuffer_size(&framebuffer, strb->surface);

24
src/mesa/state_tracker/st_cb_fbo.c
View file

@ -447,6 +447,30 @@ st_new_renderbuffer_fb(enum pipe_format format, unsigned samples, boolean sw)
return &strb->Base;
}
void
st_regen_renderbuffer_surface(struct st_context *st,
struct st_renderbuffer *strb)
{
struct pipe_context *pipe = st->pipe;
struct pipe_resource *resource = strb->texture;
struct pipe_surface **psurf =
strb->surface_srgb ? &strb->surface_srgb : &strb->surface_linear;
struct pipe_surface *surf = *psurf;
/* create a new pipe_surface */
struct pipe_surface surf_tmpl;
memset(&surf_tmpl, 0, sizeof(surf_tmpl));
surf_tmpl.format = surf->format;
surf_tmpl.nr_samples = strb->rtt_nr_samples;
surf_tmpl.u.tex.level = surf->u.tex.level;
surf_tmpl.u.tex.first_layer = surf->u.tex.first_layer;
surf_tmpl.u.tex.last_layer = surf->u.tex.last_layer;
pipe_surface_release(pipe, psurf);
*psurf = pipe->create_surface(pipe, resource, &surf_tmpl);
strb->surface = *psurf;
}
/**
* Create or update the pipe_surface of a FBO renderbuffer.

4
src/mesa/state_tracker/st_cb_fbo.h
View file

@ -112,4 +112,8 @@ st_update_renderbuffer_surface(struct st_context *st,
extern void
st_init_fbo_functions(struct dd_function_table *functions);
extern void
st_regen_renderbuffer_surface(struct st_context *st,
struct st_renderbuffer *strb);
#endif /* ST_CB_FBO_H */