From 8876a87565b995a5652c71802392f7449f4f8957 Mon Sep 17 00:00:00 2001 From: Witold Baryluk Date: Fri, 15 Oct 2021 00:29:47 +0200 Subject: [PATCH] zink: Do not access just freed zink_batch_state Cc: mesa-stable Reviewed-by: Mike Blumenkrantz Part-of: (cherry picked from commit 4d777631b595075169830a63b4281e9f0cbb45be) --- .pick_status.json | 2 +- src/gallium/drivers/zink/zink_context.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 82679bfd8c8..525d4e608b3 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1678,7 +1678,7 @@ "description": "zink: Do not access just freed zink_batch_state", "nominated": true, "nomination_type": 0, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": null }, diff --git a/src/gallium/drivers/zink/zink_context.c b/src/gallium/drivers/zink/zink_context.c index 536268255b7..826ae3ce5fd 100644 --- a/src/gallium/drivers/zink/zink_context.c +++ b/src/gallium/drivers/zink/zink_context.c @@ -105,9 +105,12 @@ zink_context_destroy(struct pipe_context *pctx) simple_mtx_destroy(&ctx->batch_mtx); zink_clear_batch_state(ctx, ctx->batch.state); zink_batch_state_destroy(screen, ctx->batch.state); - for (struct zink_batch_state *bs = ctx->batch_states; bs; bs = bs->next) { + struct zink_batch_state *bs = ctx->batch_states; + while (bs) { + struct zink_batch_state *bs_next = bs->next; zink_clear_batch_state(ctx, bs); zink_batch_state_destroy(screen, bs); + bs = bs_next; } util_dynarray_foreach(&ctx->free_batch_states, struct zink_batch_state*, bs) { zink_clear_batch_state(ctx, *bs);