fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 11:28:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

egl: set TSD as NULL after deinit

Browse source 
When eglReleaseThread() is called from application's
destructor (API with __attribute__((destructor))),
it crashes due to invalid memory access.

In this case, _egl_TLS is freed in the flow of
_eglAtExit() as below but _egl_TLS is not set to NULL.

    _eglDestroyThreadInfo
        _eglFiniTSD
            _eglAtExit
                _run_exit_handlers
                    exit

Later when the eglReleaseThread is called from
application's destructor, it ends-up accessing
the freed _egl_TLS pointer.

    eglReleaseThread -> in libEGL_mesa
        eglReleaseThread -> in libEGL(glvnd)
            destructor() -> App's destructor

To resolve the invalid access, setting the _egl_TLS
pointer as NULL after freeing it.

Reviewed-by: Eric Engestrom <eric@engestrom.ch>
Reviewed-by: Jesse Natalie <jenatali@microsoft.com>
Reviewed-by: Tapani Pälli <tapani.palli@intel.com>
Cc: mesa-stable

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5466
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13302>
(cherry picked from commit 796c9ab3fd)
This commit is contained in:
Maniraj D 2021-10-11 22:37:02 +05:30 • committed by Eric Engestrom
parent 071ce0bbc7
commit 9b68854c2e
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -1651,7 +1651,7 @@
"description": "egl: set TSD as NULL after deinit",
"nominated": true,
"nomination_type": 0,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": null
},

8
src/egl/main/eglcurrent.c
View file

@ -131,8 +131,14 @@ _eglCreateThreadInfo(void)
static void
_eglDestroyThreadInfo(_EGLThreadInfo *t)
{
if (t != &dummy_thread)
if (t != &dummy_thread) {
free(t);
#ifdef USE_ELF_TLS
/* Reset the TLS also here, otherwise
* it will be having a dangling pointer */
_egl_TLS = NULL;
#endif
}
}