From 5ddac7c5e7de8ebf3ed8a529b8ae3bccdc0fd0e6 Mon Sep 17 00:00:00 2001 From: Rhys Perry Date: Fri, 23 Apr 2021 12:49:33 +0100 Subject: [PATCH] vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT Signed-off-by: Rhys Perry Reviewed-by: Lionel Landwerlin Reviewed-by: Jason Ekstrand Reviewed-by: Samuel Pitoiset Fixes: bd1705a4808 ("vulkan: Make vk_debug_report_callback derive from vk_object_base") Part-of: (cherry picked from commit 32ebbd8c2351ac45953667e0fa4d82ebc49eaf7d) --- .pick_status.json | 2 +- src/vulkan/util/vk_debug_report.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 652f042db8a..e210f7b7ba2 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -31,7 +31,7 @@ "description": "vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "master_sha": null, "because_sha": "bd1705a4808f61513f5ff818679efd5c5f105f8a" }, diff --git a/src/vulkan/util/vk_debug_report.c b/src/vulkan/util/vk_debug_report.c index 376d7248347..db89e3d6f5d 100644 --- a/src/vulkan/util/vk_debug_report.c +++ b/src/vulkan/util/vk_debug_report.c @@ -88,10 +88,9 @@ vk_common_DestroyDebugReportCallbackEXT(VkInstance _instance, /* Remove from list and destroy given callback. */ mtx_lock(&instance->debug_report.callbacks_mutex); list_del(&callback->link); + vk_object_base_finish(&callback->base); vk_free2(&instance->alloc, pAllocator, callback); mtx_unlock(&instance->debug_report.callbacks_mutex); - - vk_object_base_finish(&callback->base); } static void