86 lines
3.5 KiB
Diff
86 lines
3.5 KiB
Diff
|
From 507f0230d4ca2238c818006499e21abb4c133203 Mon Sep 17 00:00:00 2001
|
||
|
From: Ilia Mirkin <imirkin@alum.mit.edu>
|
||
|
Date: Thu, 06 Mar 2014 03:25:55 +0000
|
||
|
Subject: nouveau: fix fence waiting logic in screen destroy
|
||
|
|
||
|
nouveau_fence_wait has the expectation that an external entity is
|
||
|
holding onto the fence being waited on, not that it is merely held onto
|
||
|
by the current pointer. Fixes a use-after-free in nouveau_fence_wait
|
||
|
when used on the screen's current fence.
|
||
|
|
||
|
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75279
|
||
|
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
|
||
|
Reviewed-by: Christoph Bumiller <e0425955@student.tuwien.ac.at>
|
||
|
Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
|
||
|
---
|
||
|
diff --git a/src/gallium/drivers/nouveau/nv30/nv30_screen.c b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
|
||
|
index 82f2c06..5378913 100644
|
||
|
--- a/src/gallium/drivers/nouveau/nv30/nv30_screen.c
|
||
|
+++ b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
|
||
|
@@ -308,10 +308,16 @@ nv30_screen_destroy(struct pipe_screen *pscreen)
|
||
|
if (!nouveau_drm_screen_unref(&screen->base))
|
||
|
return;
|
||
|
|
||
|
- if (screen->base.fence.current &&
|
||
|
- screen->base.fence.current->state >= NOUVEAU_FENCE_STATE_EMITTED) {
|
||
|
- nouveau_fence_wait(screen->base.fence.current);
|
||
|
- nouveau_fence_ref (NULL, &screen->base.fence.current);
|
||
|
+ if (screen->base.fence.current) {
|
||
|
+ struct nouveau_fence *current = NULL;
|
||
|
+
|
||
|
+ /* nouveau_fence_wait will create a new current fence, so wait on the
|
||
|
+ * _current_ one, and remove both.
|
||
|
+ */
|
||
|
+ nouveau_fence_ref(screen->base.fence.current, ¤t);
|
||
|
+ nouveau_fence_wait(current);
|
||
|
+ nouveau_fence_ref(NULL, ¤t);
|
||
|
+ nouveau_fence_ref(NULL, &screen->base.fence.current);
|
||
|
}
|
||
|
|
||
|
nouveau_object_del(&screen->query);
|
||
|
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_screen.c b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
|
||
|
index ab0d63e..e8c7fe3 100644
|
||
|
--- a/src/gallium/drivers/nouveau/nv50/nv50_screen.c
|
||
|
+++ b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
|
||
|
@@ -294,8 +294,15 @@ nv50_screen_destroy(struct pipe_screen *pscreen)
|
||
|
return;
|
||
|
|
||
|
if (screen->base.fence.current) {
|
||
|
- nouveau_fence_wait(screen->base.fence.current);
|
||
|
- nouveau_fence_ref (NULL, &screen->base.fence.current);
|
||
|
+ struct nouveau_fence *current = NULL;
|
||
|
+
|
||
|
+ /* nouveau_fence_wait will create a new current fence, so wait on the
|
||
|
+ * _current_ one, and remove both.
|
||
|
+ */
|
||
|
+ nouveau_fence_ref(screen->base.fence.current, ¤t);
|
||
|
+ nouveau_fence_wait(current);
|
||
|
+ nouveau_fence_ref(NULL, ¤t);
|
||
|
+ nouveau_fence_ref(NULL, &screen->base.fence.current);
|
||
|
}
|
||
|
if (screen->base.pushbuf)
|
||
|
screen->base.pushbuf->user_priv = NULL;
|
||
|
diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
|
||
|
index 044847d..04f3088 100644
|
||
|
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
|
||
|
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
|
||
|
@@ -340,7 +340,14 @@ nvc0_screen_destroy(struct pipe_screen *pscreen)
|
||
|
return;
|
||
|
|
||
|
if (screen->base.fence.current) {
|
||
|
- nouveau_fence_wait(screen->base.fence.current);
|
||
|
+ struct nouveau_fence *current = NULL;
|
||
|
+
|
||
|
+ /* nouveau_fence_wait will create a new current fence, so wait on the
|
||
|
+ * _current_ one, and remove both.
|
||
|
+ */
|
||
|
+ nouveau_fence_ref(screen->base.fence.current, ¤t);
|
||
|
+ nouveau_fence_wait(current);
|
||
|
+ nouveau_fence_ref(NULL, ¤t);
|
||
|
nouveau_fence_ref(NULL, &screen->base.fence.current);
|
||
|
}
|
||
|
if (screen->base.pushbuf)
|
||
|
--
|
||
|
cgit v0.9.0.2-2-gbebe
|
||
|
|