Re: [Mesa-dev] [PATCH] gallium/util: Fix incorrect refcounting of separate stencil.

[Rob Clark]

On Wed, Apr 25, 2018 at 12:49 PM, Eric Anholt  wrote:
> The driver may have a reference on the separate stencil buffer for some
> reason (like an unflushed job using it), so we can't directly free the
> resource and should instead just decrement the refcount that we own.
> Fixes double-free in KHR-GLES3.packed_depth_stencil.blit.depth32f_stencil8
> on vc5.
>
> Fixes: e94eb5e6000e ("gallium/util: add u_transfer_helper")

oh, whoops

Reviewed-by: Rob Clark 

> ---
>  src/gallium/auxiliary/util/u_transfer_helper.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/src/gallium/auxiliary/util/u_transfer_helper.c 
> b/src/gallium/auxiliary/util/u_transfer_helper.c
> index dd31049920fc..3b085fd99f09 100644
> --- a/src/gallium/auxiliary/util/u_transfer_helper.c
> +++ b/src/gallium/auxiliary/util/u_transfer_helper.c
> @@ -138,8 +138,7 @@ u_transfer_helper_resource_destroy(struct pipe_screen 
> *pscreen,
> if (helper->vtbl->get_stencil) {
>struct pipe_resource *stencil = helper->vtbl->get_stencil(prsc);
>
> -  if (stencil)
> - helper->vtbl->resource_destroy(pscreen, stencil);
> +  pipe_resource_reference(, NULL);
> }
>
> helper->vtbl->resource_destroy(pscreen, prsc);
> --
> 2.17.0
>
> ___
> mesa-dev mailing list
> mesa-dev@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev

[Mesa-dev] [PATCH] gallium/util: Fix incorrect refcounting of separate stencil.

[Eric Anholt]

The driver may have a reference on the separate stencil buffer for some
reason (like an unflushed job using it), so we can't directly free the
resource and should instead just decrement the refcount that we own.
Fixes double-free in KHR-GLES3.packed_depth_stencil.blit.depth32f_stencil8
on vc5.

Fixes: e94eb5e6000e ("gallium/util: add u_transfer_helper")
---
 src/gallium/auxiliary/util/u_transfer_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/gallium/auxiliary/util/u_transfer_helper.c 
b/src/gallium/auxiliary/util/u_transfer_helper.c
index dd31049920fc..3b085fd99f09 100644
--- a/src/gallium/auxiliary/util/u_transfer_helper.c
+++ b/src/gallium/auxiliary/util/u_transfer_helper.c
@@ -138,8 +138,7 @@ u_transfer_helper_resource_destroy(struct pipe_screen 
*pscreen,
if (helper->vtbl->get_stencil) {
   struct pipe_resource *stencil = helper->vtbl->get_stencil(prsc);
 
-  if (stencil)
- helper->vtbl->resource_destroy(pscreen, stencil);
+  pipe_resource_reference(, NULL);
}
 
helper->vtbl->resource_destroy(pscreen, prsc);
-- 
2.17.0

___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev