summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichel Dänzer <michel.daenzer@amd.com>2014-10-21 12:40:15 +0900
committerEmil Velikov <emil.l.velikov@gmail.com>2014-10-22 15:39:49 +0100
commit724f71ef3905289eee7b45955243fdc7dc5f1251 (patch)
tree046c07136bea7762ce5eb8c671d4ee99192d8cb5
parent6fa07d1d4842169906155c6de58475fefe780204 (diff)
r600g: Drop references to destroyed blend state
Fixes use-after-free when the currently bound blend state is destroyed. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85267 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84140 Reviewed-by: Marek Olšák <marek.olsak@amd.com> Tested-by: Dieter Nützel <Dieter@nuetzel-hh.de> Cc: mesa-stable@lists.freedesktop.org (cherry picked from commit ae879718c4086fc5905070e7f26dfa2757df0c86)
-rw-r--r--src/gallium/drivers/r600/r600_state_common.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/src/gallium/drivers/r600/r600_state_common.c b/src/gallium/drivers/r600/r600_state_common.c
index d9174a59230..a050a5377cd 100644
--- a/src/gallium/drivers/r600/r600_state_common.c
+++ b/src/gallium/drivers/r600/r600_state_common.c
@@ -158,8 +158,10 @@ static void r600_bind_blend_state(struct pipe_context *ctx, void *state)
struct r600_context *rctx = (struct r600_context *)ctx;
struct r600_blend_state *blend = (struct r600_blend_state *)state;
- if (blend == NULL)
+ if (blend == NULL) {
+ r600_set_cso_state_with_cb(&rctx->blend_state, NULL, NULL);
return;
+ }
r600_bind_blend_state_internal(rctx, blend, rctx->force_blend_disable);
}
@@ -447,8 +449,13 @@ static void r600_delete_sampler_state(struct pipe_context *ctx, void *state)
static void r600_delete_blend_state(struct pipe_context *ctx, void *state)
{
+ struct r600_context *rctx = (struct r600_context *)ctx;
struct r600_blend_state *blend = (struct r600_blend_state*)state;
+ if (rctx->blend_state.cso == state) {
+ ctx->bind_blend_state(ctx, NULL);
+ }
+
r600_release_command_buffer(&blend->buffer);
r600_release_command_buffer(&blend->buffer_no_blend);
FREE(blend);