Mesa (master): turnip: Only write the tu_RegisterDeviceEXT() out fence on success.

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: 7ae07191172a5d4fb402d196f68edb9ef1bdb0fe
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=7ae07191172a5d4fb402d196f68edb9ef1bdb0fe

Author: Eric Anholt <eric at anholt.net>
Date:   Mon Apr 26 14:10:42 2021 -0700

turnip: Only write the tu_RegisterDeviceEXT() out fence on success.

Fixes a double-free in dEQP-VK.wsi.display_control.register_device_event
where the fence that we destroyed got destroyed again.  Leaving it unset
in the error path leaves the test's NULL in place.

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/10473>

---

 src/freedreno/vulkan/tu_wsi_display.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/freedreno/vulkan/tu_wsi_display.c b/src/freedreno/vulkan/tu_wsi_display.c
index 76fbb4b8702..38a134c08e9 100644
--- a/src/freedreno/vulkan/tu_wsi_display.c
+++ b/src/freedreno/vulkan/tu_wsi_display.c
@@ -263,16 +263,17 @@ VkResult
 tu_RegisterDeviceEventEXT(VkDevice                    _device,
                           const VkDeviceEventInfoEXT  *device_event_info,
                           const VkAllocationCallbacks *allocator,
-                          VkFence                     *_fence)
+                          VkFence                     *out_fence)
 {
    TU_FROM_HANDLE(tu_device, device, _device);
    VkResult ret;
 
-   ret = tu_CreateFence(_device, &(VkFenceCreateInfo) {}, allocator, _fence);
+   VkFence _fence;
+   ret = tu_CreateFence(_device, &(VkFenceCreateInfo) {}, allocator, &_fence);
    if (ret != VK_SUCCESS)
       return ret;
 
-   TU_FROM_HANDLE(tu_syncobj, fence, *_fence);
+   TU_FROM_HANDLE(tu_syncobj, fence, _fence);
 
    int sync_fd = tu_syncobj_to_fd(device, fence);
    if (sync_fd >= 0) {
@@ -289,7 +290,9 @@ tu_RegisterDeviceEventEXT(VkDevice                    _device,
    }
 
    if (ret != VK_SUCCESS)
-      tu_DestroyFence(_device, *_fence, allocator);
+      tu_DestroyFence(_device, _fence, allocator);
+   else
+      *out_fence = _fence;
 
    return ret;
 }