fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-07 23:50:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

broadcom/vc4: Fix use-after-free when deleting a program.

Browse source 
By leaving the compiled shader in the context's stage state, the next
compile of a new FS would look in the old compiled FS for figuring out
whether to set various dirty flags for the VS compile.  Clear out the
pointer when deleting the program, and make sure that we always mark the
state as dirty if the previous program had been lost.  Fixes valgrind
warnings on glsl-max-varyings.

Fixes: 2350569a78 ("vc4: Avoid VS shader recompiles by keeping a set of FS inputs seen so far.")
(cherry picked from commit 3752ad28f2)
This commit is contained in:
Eric Anholt 2017-09-18 17:47:44 -07:00 • committed by Juan A. Suarez Romero
parent f6469ac143
commit 4e10705200
1 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/gallium/drivers/vc4/vc4_program.c
View file

@ -2763,11 +2763,11 @@ vc4_update_compiled_fs(struct vc4_context *vc4, uint8_t prim_mode)
vc4->dirty |= VC4_DIRTY_COMPILED_FS;
if (vc4->rasterizer->base.flatshade &&
old_fs && vc4->prog.fs->color_inputs != old_fs->color_inputs) {
(!old_fs || vc4->prog.fs->color_inputs != old_fs->color_inputs)) {
vc4->dirty |= VC4_DIRTY_FLAT_SHADE_FLAGS;
}
if (old_fs && vc4->prog.fs->fs_inputs != old_fs->fs_inputs)
if (!old_fs || vc4->prog.fs->fs_inputs != old_fs->fs_inputs)
vc4->dirty |= VC4_DIRTY_FS_INPUTS;
}
@ -2877,6 +2877,7 @@ fs_inputs_compare(const void *key1, const void *key2)
static void
delete_from_cache_if_matches(struct hash_table *ht,
struct vc4_compiled_shader **last_compile,
struct hash_entry *entry,
struct vc4_uncompiled_shader *so)
{
@ -2886,6 +2887,10 @@ delete_from_cache_if_matches(struct hash_table *ht,
struct vc4_compiled_shader *shader = entry->data;
_mesa_hash_table_remove(ht, entry);
vc4_bo_unreference(&shader->bo);
if (shader == *last_compile)
*last_compile = NULL;
ralloc_free(shader);
}
}
@ -2897,10 +2902,14 @@ vc4_shader_state_delete(struct pipe_context *pctx, void *hwcso)
struct vc4_uncompiled_shader *so = hwcso;
struct hash_entry *entry;
hash_table_foreach(vc4->fs_cache, entry)
delete_from_cache_if_matches(vc4->fs_cache, entry, so);
hash_table_foreach(vc4->vs_cache, entry)
delete_from_cache_if_matches(vc4->vs_cache, entry, so);
hash_table_foreach(vc4->fs_cache, entry) {
delete_from_cache_if_matches(vc4->fs_cache, &vc4->prog.fs,
entry, so);
}
hash_table_foreach(vc4->vs_cache, entry) {
delete_from_cache_if_matches(vc4->vs_cache, &vc4->prog.vs,
entry, so);
}
ralloc_free(so->base.ir.nir);
free(so);