From d6894b643b8079b2c2b16de18c856008cd922cca Mon Sep 17 00:00:00 2001 From: Rhys Perry Date: Fri, 23 Apr 2021 13:03:01 +0100 Subject: [PATCH] radv: fix use-after-free upon GS copy shader cache hits If radv_pipeline_cache_insert_shaders() finds a GS copy shader in the cache, it will free the variant in gs_variants and replace it with the one in the cache. Signed-off-by: Rhys Perry Reviewed-by: Samuel Pitoiset Cc: mesa-stable Part-of: --- src/amd/vulkan/radv_pipeline.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/amd/vulkan/radv_pipeline.c b/src/amd/vulkan/radv_pipeline.c index c4ee3e9e5b4..8c2451a8ec6 100644 --- a/src/amd/vulkan/radv_pipeline.c +++ b/src/amd/vulkan/radv_pipeline.c @@ -3480,6 +3480,8 @@ radv_create_shaders(struct radv_pipeline *pipeline, struct radv_device *device, gs_variants[MESA_SHADER_GEOMETRY] = pipeline->gs_copy_shader; radv_pipeline_cache_insert_shaders(device, cache, gs_copy_hash, gs_variants, gs_binaries); + + pipeline->gs_copy_shader = gs_variants[MESA_SHADER_GEOMETRY]; } free(gs_copy_binary); }