<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:andreas.ringlstetter@gmail.com" title="Andreas Ringlstetter <andreas.ringlstetter@gmail.com>"> <span class="fn">Andreas Ringlstetter</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED INVALID - Massive memory corruption in Planetary Annihilation Alpha"
href="https://bugs.freedesktop.org/show_bug.cgi?id=65968">bug 65968</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>INVALID
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED INVALID - Massive memory corruption in Planetary Annihilation Alpha"
href="https://bugs.freedesktop.org/show_bug.cgi?id=65968#c12">Comment # 12</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED INVALID - Massive memory corruption in Planetary Annihilation Alpha"
href="https://bugs.freedesktop.org/show_bug.cgi?id=65968">bug 65968</a>
from <span class="vcard"><a class="email" href="mailto:andreas.ringlstetter@gmail.com" title="Andreas Ringlstetter <andreas.ringlstetter@gmail.com>"> <span class="fn">Andreas Ringlstetter</span></a>
</span></b>
<pre>It's a bug in PA itself, not in Mesa.
The root cause is a race condition on the shared buffer which is used to
transfer the rendered HTML UI from the Coherent host process back to PA.
There is a missing mutex inside PA when the buffer gets reallocated as a result
of a window resize event. Effectively, this results in a use-after-free by the
render thread of the PA process.
The faster the realloc, the lower the chance of this bug occurring.
It's also subject to possibly missing protections against use after free
conditions on previously shared buffers. And also to the memory allocation
strategy, as a reuse of the same memory region without a clear leads to the
most visible effect.
Unfortunately, various Mesa drivers so not wipe the video memory after a buffer
was returned to the global pool!</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>