From 2c8eba7188d2820a4523dfb5b5909244c3ee4740 Mon Sep 17 00:00:00 2001 From: Rhys Perry Date: Fri, 23 Apr 2021 13:03:01 +0100 Subject: [PATCH] radv: fix use-after-free upon GS copy shader cache hits If radv_pipeline_cache_insert_shaders() finds a GS copy shader in the cache, it will free the variant in gs_variants and replace it with the one in the cache. Signed-off-by: Rhys Perry Reviewed-by: Samuel Pitoiset Cc: mesa-stable Part-of: (cherry picked from commit d6894b643b8079b2c2b16de18c856008cd922cca) --- .pick_status.json | 2 +- src/amd/vulkan/radv_pipeline.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.pick_status.json b/.pick_status.json index e210f7b7ba2..a7ede526528 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -22,7 +22,7 @@ "description": "radv: fix use-after-free upon GS copy shader cache hits", "nominated": true, "nomination_type": 0, - "resolution": 0, + "resolution": 1, "master_sha": null, "because_sha": null }, diff --git a/src/amd/vulkan/radv_pipeline.c b/src/amd/vulkan/radv_pipeline.c index 7db89b54d6e..e8561b3a5f2 100644 --- a/src/amd/vulkan/radv_pipeline.c +++ b/src/amd/vulkan/radv_pipeline.c @@ -3444,6 +3444,8 @@ radv_create_shaders(struct radv_pipeline *pipeline, struct radv_device *device, gs_variants[MESA_SHADER_GEOMETRY] = pipeline->gs_copy_shader; radv_pipeline_cache_insert_shaders(device, cache, gs_copy_hash, gs_variants, gs_binaries); + + pipeline->gs_copy_shader = gs_variants[MESA_SHADER_GEOMETRY]; } free(gs_copy_binary); }