fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-06 08:50:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

radv: Remove arenas from capture_replay_arena_vas

Browse source 
Avoids an use after free when looking up an arena.

cc: mesa-stable

Reviewed-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/28961>
This commit is contained in:
Konstantin Seurer 2024-04-28 15:57:30 +02:00 • committed by Marge Bot
parent e050abc961
commit df82221bb3
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/amd/vulkan/radv_device.c
View file

@ -1294,9 +1294,6 @@ radv_DestroyDevice(VkDevice _device, const VkAllocationCallbacks *pAllocator)
if (!device)
return;
if (device->capture_replay_arena_vas)
_mesa_hash_table_u64_destroy(device->capture_replay_arena_vas);
radv_device_finish_perf_counter_lock_cs(device);
if (device->perf_counter_bo)
radv_bo_destroy(device, NULL, device->perf_counter_bo);
@ -1347,6 +1344,8 @@ radv_DestroyDevice(VkDevice _device, const VkAllocationCallbacks *pAllocator)
radv_finish_trace(device);
radv_destroy_shader_arenas(device);
if (device->capture_replay_arena_vas)
_mesa_hash_table_u64_destroy(device->capture_replay_arena_vas);
radv_printf_data_finish(device);

12
src/amd/vulkan/radv_shader.c
View file

@ -1153,6 +1153,18 @@ radv_free_shader_memory(struct radv_device *device, union radv_shader_arena_bloc
radv_bo_destroy(device, NULL, arena->bo);
list_del(&arena->list);
if (device->capture_replay_arena_vas) {
struct hash_entry *arena_entry = NULL;
hash_table_foreach (device->capture_replay_arena_vas->table, entry) {
if (entry->data == arena) {
arena_entry = entry;
break;
}
}
_mesa_hash_table_remove(device->capture_replay_arena_vas->table, arena_entry);
}
free(arena);
} else if (free_list) {
add_hole(free_list, hole);