vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT

Signed-off-by: Rhys Perry <pendingchaos02@gmail.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Reviewed-by: Jason Ekstrand <jason@jlekstrand.net>
Reviewed-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Fixes: bd1705a480 ("vulkan: Make vk_debug_report_callback derive from vk_object_base")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/10433>
(cherry picked from commit 32ebbd8c23)
This commit is contained in:
Rhys Perry 2021-04-23 12:49:33 +01:00 committed by Dylan Baker
parent a3237b0dd3
commit 5ddac7c5e7
2 changed files with 2 additions and 3 deletions

View file

@ -31,7 +31,7 @@
"description": "vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"master_sha": null,
"because_sha": "bd1705a4808f61513f5ff818679efd5c5f105f8a"
},

View file

@ -88,10 +88,9 @@ vk_common_DestroyDebugReportCallbackEXT(VkInstance _instance,
/* Remove from list and destroy given callback. */
mtx_lock(&instance->debug_report.callbacks_mutex);
list_del(&callback->link);
vk_object_base_finish(&callback->base);
vk_free2(&instance->alloc, pAllocator, callback);
mtx_unlock(&instance->debug_report.callbacks_mutex);
vk_object_base_finish(&callback->base);
}
static void