summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIlia Mirkin <imirkin@alum.mit.edu>2014-03-05 22:25:55 -0500
committerIlia Mirkin <imirkin@alum.mit.edu>2014-03-09 01:31:59 -0500
commit507f0230d4ca2238c818006499e21abb4c133203 (patch)
tree275952fc89d630d424006ff46d2ca70d8c0d1f7a
parent5bf90cb521d1d6f26684b1ce9d0811c636b6abb1 (diff)
nouveau: fix fence waiting logic in screen destroy
nouveau_fence_wait has the expectation that an external entity is holding onto the fence being waited on, not that it is merely held onto by the current pointer. Fixes a use-after-free in nouveau_fence_wait when used on the screen's current fence. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75279 Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu> Reviewed-by: Christoph Bumiller <e0425955@student.tuwien.ac.at> Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
-rw-r--r--src/gallium/drivers/nouveau/nv30/nv30_screen.c14
-rw-r--r--src/gallium/drivers/nouveau/nv50/nv50_screen.c11
-rw-r--r--src/gallium/drivers/nouveau/nvc0/nvc0_screen.c9
3 files changed, 27 insertions, 7 deletions
diff --git a/src/gallium/drivers/nouveau/nv30/nv30_screen.c b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
index 82f2c069467..5378913884f 100644
--- a/src/gallium/drivers/nouveau/nv30/nv30_screen.c
+++ b/src/gallium/drivers/nouveau/nv30/nv30_screen.c
@@ -308,10 +308,16 @@ nv30_screen_destroy(struct pipe_screen *pscreen)
if (!nouveau_drm_screen_unref(&screen->base))
return;
- if (screen->base.fence.current &&
- screen->base.fence.current->state >= NOUVEAU_FENCE_STATE_EMITTED) {
- nouveau_fence_wait(screen->base.fence.current);
- nouveau_fence_ref (NULL, &screen->base.fence.current);
+ if (screen->base.fence.current) {
+ struct nouveau_fence *current = NULL;
+
+ /* nouveau_fence_wait will create a new current fence, so wait on the
+ * _current_ one, and remove both.
+ */
+ nouveau_fence_ref(screen->base.fence.current, &current);
+ nouveau_fence_wait(current);
+ nouveau_fence_ref(NULL, &current);
+ nouveau_fence_ref(NULL, &screen->base.fence.current);
}
nouveau_object_del(&screen->query);
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_screen.c b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
index ab0d63ea5f3..e8c7fe3cc24 100644
--- a/src/gallium/drivers/nouveau/nv50/nv50_screen.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_screen.c
@@ -294,8 +294,15 @@ nv50_screen_destroy(struct pipe_screen *pscreen)
return;
if (screen->base.fence.current) {
- nouveau_fence_wait(screen->base.fence.current);
- nouveau_fence_ref (NULL, &screen->base.fence.current);
+ struct nouveau_fence *current = NULL;
+
+ /* nouveau_fence_wait will create a new current fence, so wait on the
+ * _current_ one, and remove both.
+ */
+ nouveau_fence_ref(screen->base.fence.current, &current);
+ nouveau_fence_wait(current);
+ nouveau_fence_ref(NULL, &current);
+ nouveau_fence_ref(NULL, &screen->base.fence.current);
}
if (screen->base.pushbuf)
screen->base.pushbuf->user_priv = NULL;
diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
index 044847dfd27..04f30886a09 100644
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_screen.c
@@ -340,7 +340,14 @@ nvc0_screen_destroy(struct pipe_screen *pscreen)
return;
if (screen->base.fence.current) {
- nouveau_fence_wait(screen->base.fence.current);
+ struct nouveau_fence *current = NULL;
+
+ /* nouveau_fence_wait will create a new current fence, so wait on the
+ * _current_ one, and remove both.
+ */
+ nouveau_fence_ref(screen->base.fence.current, &current);
+ nouveau_fence_wait(current);
+ nouveau_fence_ref(NULL, &current);
nouveau_fence_ref(NULL, &screen->base.fence.current);
}
if (screen->base.pushbuf)