fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-25 04:20:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

r600g: Drop references to destroyed blend state

Browse source 
Fixes use-after-free when the currently bound blend state is destroyed.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85267
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84140

Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Tested-by: Dieter Nützel <Dieter@nuetzel-hh.de>

Cc: mesa-stable@lists.freedesktop.org
This commit is contained in:
Michel Dänzer 2014-10-21 12:40:15 +09:00 • committed by Michel Dänzer
parent 6dc6e6e0d9
commit ae879718c4
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/gallium/drivers/r600/r600_state_common.c
View file

@ -158,8 +158,10 @@ static void r600_bind_blend_state(struct pipe_context *ctx, void *state)
struct r600_context *rctx = (struct r600_context *)ctx;
struct r600_blend_state *blend = (struct r600_blend_state *)state;
if (blend == NULL)
if (blend == NULL) {
r600_set_cso_state_with_cb(&rctx->blend_state, NULL, NULL);
return;
}
r600_bind_blend_state_internal(rctx, blend, rctx->force_blend_disable);
}
@ -447,8 +449,13 @@ static void r600_delete_sampler_state(struct pipe_context *ctx, void *state)
static void r600_delete_blend_state(struct pipe_context *ctx, void *state)
{
struct r600_context *rctx = (struct r600_context *)ctx;
struct r600_blend_state *blend = (struct r600_blend_state*)state;
if (rctx->blend_state.cso == state) {
ctx->bind_blend_state(ctx, NULL);
}
r600_release_command_buffer(&blend->buffer);
r600_release_command_buffer(&blend->buffer_no_blend);
FREE(blend);