fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 13:58:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

nouveau: fix fence waiting logic in screen destroy

Browse source 
nouveau_fence_wait has the expectation that an external entity is
holding onto the fence being waited on, not that it is merely held onto
by the current pointer. Fixes a use-after-free in nouveau_fence_wait
when used on the screen's current fence.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75279
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Christoph Bumiller <e0425955@student.tuwien.ac.at>
Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
(cherry picked from commit 507f0230d4)

Conflicts:
	src/gallium/drivers/nouveau/nv30/nv30_screen.c
This commit is contained in:
Ilia Mirkin 2014-03-05 22:25:55 -05:00 • committed by Carl Worth
parent 5ad6062ee6
commit 860ee22480
3 changed files with 27 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/gallium/drivers/nouveau/nv30/nv30_screen.c
View file

@ -298,10 +298,16 @@ nv30_screen_destroy(struct pipe_screen *pscreen)
{
struct nv30_screen *screen = nv30_screen(pscreen);
if (screen->base.fence.current &&
screen->base.fence.current->state >= NOUVEAU_FENCE_STATE_EMITTED) {
nouveau_fence_wait(screen->base.fence.current);
nouveau_fence_ref (NULL, &screen->base.fence.current);
if (screen->base.fence.current) {
struct nouveau_fence *current = NULL;
/* nouveau_fence_wait will create a new current fence, so wait on the
* _current_ one, and remove both.
*/
nouveau_fence_ref(screen->base.fence.current, &current);
nouveau_fence_wait(current);
nouveau_fence_ref(NULL, &current);
nouveau_fence_ref(NULL, &screen->base.fence.current);
}
nouveau_object_del(&screen->query);

11
src/gallium/drivers/nouveau/nv50/nv50_screen.c
View file

@ -283,8 +283,15 @@ nv50_screen_destroy(struct pipe_screen *pscreen)
struct nv50_screen *screen = nv50_screen(pscreen);
if (screen->base.fence.current) {
nouveau_fence_wait(screen->base.fence.current);
nouveau_fence_ref (NULL, &screen->base.fence.current);
struct nouveau_fence *current = NULL;
/* nouveau_fence_wait will create a new current fence, so wait on the
* _current_ one, and remove both.
*/
nouveau_fence_ref(screen->base.fence.current, &current);
nouveau_fence_wait(current);
nouveau_fence_ref(NULL, &current);
nouveau_fence_ref(NULL, &screen->base.fence.current);
}
if (screen->base.pushbuf)
screen->base.pushbuf->user_priv = NULL;

9
src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
View file

@ -331,7 +331,14 @@ nvc0_screen_destroy(struct pipe_screen *pscreen)
struct nvc0_screen *screen = nvc0_screen(pscreen);
if (screen->base.fence.current) {
nouveau_fence_wait(screen->base.fence.current);
struct nouveau_fence *current = NULL;
/* nouveau_fence_wait will create a new current fence, so wait on the
* _current_ one, and remove both.
*/
nouveau_fence_ref(screen->base.fence.current, &current);
nouveau_fence_wait(current);
nouveau_fence_ref(NULL, &current);
nouveau_fence_ref(NULL, &screen->base.fence.current);
}
if (screen->base.pushbuf)