From d3c67d7e7ec6b9cf10fbea0d08e92751b7b0fbae Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Tue, 1 Dec 2020 13:47:28 -0800 Subject: [PATCH] freedreno: Break out of "should we free the entry" loop once we've freed. Fixes a use-after-free of the state on the next iteration when it was probably just destroyed. Fixes: 6de01faac5a2 ("freedreno/a6xx: invalidate tex state cache entries on rebind") Part-of: --- src/gallium/drivers/freedreno/a6xx/fd6_texture.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/gallium/drivers/freedreno/a6xx/fd6_texture.c b/src/gallium/drivers/freedreno/a6xx/fd6_texture.c index 7c555968eaf..84f16366cae 100644 --- a/src/gallium/drivers/freedreno/a6xx/fd6_texture.c +++ b/src/gallium/drivers/freedreno/a6xx/fd6_texture.c @@ -512,6 +512,7 @@ fd6_rebind_resource(struct fd_context *ctx, struct fd_resource *rsc) for (unsigned i = 0; i < ARRAY_SIZE(state->key.view); i++) { if (rsc->seqno == state->key.view[i].rsc_seqno) { remove_tex_entry(fd6_ctx, entry); + break; } } }