diff options
| author | Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> | 2020-09-02 11:58:12 +0200 |
|---|---|---|
| committer | Eric Engestrom <eric@engestrom.ch> | 2020-09-16 19:23:28 +0200 |
| commit | 2dc3d4c6485a95288ceec59fffd93a17509d1388 (patch) | |
| tree | 72a41e090b0fab370399c1002353d8926e407cba | |
| parent | d0634a167ca9a5850bf02d91d0ef869bf4c79eae (diff) | |
r600/uvd: set dec->bs_ptr = NULL on unmap
To avoid using a dangling pointer.
See https://gitlab.freedesktop.org/mesa/mesa/-/issues/1308
Cc: mesa-stable
Reviewed-by: Boyuan Zhang <boyuan.zhang@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6556>
(cherry picked from commit eb60849ea2484c6ba09843ce1c29ba161fa6d02e)
| -rw-r--r-- | .pick_status.json | 2 | ||||
| -rw-r--r-- | src/gallium/drivers/r600/radeon_uvd.c | 3 |
2 files changed, 4 insertions, 1 deletions
diff --git a/.pick_status.json b/.pick_status.json index 945c99d2255..a840c59493c 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -229,7 +229,7 @@ "description": "r600/uvd: set dec->bs_ptr = NULL on unmap", "nominated": true, "nomination_type": 0, - "resolution": 0, + "resolution": 1, "master_sha": null, "because_sha": null }, diff --git a/src/gallium/drivers/r600/radeon_uvd.c b/src/gallium/drivers/r600/radeon_uvd.c index e7107c0b49b..4da0343bd1c 100644 --- a/src/gallium/drivers/r600/radeon_uvd.c +++ b/src/gallium/drivers/r600/radeon_uvd.c @@ -178,6 +178,7 @@ static void send_msg_buf(struct ruvd_decoder *dec) /* unmap the buffer */ dec->ws->buffer_unmap(buf->res->buf); + dec->bs_ptr = NULL; dec->msg = NULL; dec->fb = NULL; dec->it = NULL; @@ -1087,6 +1088,7 @@ static void ruvd_decode_bitstream(struct pipe_video_codec *decoder, if (new_size > buf->res->buf->size) { dec->ws->buffer_unmap(buf->res->buf); + dec->bs_ptr = NULL; if (!rvid_resize_buffer(dec->screen, dec->cs, buf, new_size)) { RVID_ERR("Can't resize bitstream buffer!"); return; @@ -1137,6 +1139,7 @@ static void ruvd_end_frame(struct pipe_video_codec *decoder, bs_size = align(dec->bs_size, 128); memset(dec->bs_ptr, 0, bs_size - dec->bs_size); dec->ws->buffer_unmap(bs_buf->res->buf); + dec->bs_ptr = NULL; map_msg_fb_it_buf(dec); dec->msg->size = sizeof(*dec->msg); |