Mesa (master): vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: 32ebbd8c2351ac45953667e0fa4d82ebc49eaf7d
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=32ebbd8c2351ac45953667e0fa4d82ebc49eaf7d

Author: Rhys Perry <pendingchaos02 at gmail.com>
Date:   Fri Apr 23 12:49:33 2021 +0100

vulkan: fix use-after-free in vk_common_DestroyDebugReportCallbackEXT

Signed-off-by: Rhys Perry <pendingchaos02 at gmail.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Reviewed-by: Jason Ekstrand <jason at jlekstrand.net>
Reviewed-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
Fixes: bd1705a4808 ("vulkan: Make vk_debug_report_callback derive from vk_object_base")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/10433>

---

 src/vulkan/util/vk_debug_report.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/vulkan/util/vk_debug_report.c b/src/vulkan/util/vk_debug_report.c
index 376d7248347..db89e3d6f5d 100644
--- a/src/vulkan/util/vk_debug_report.c
+++ b/src/vulkan/util/vk_debug_report.c
@@ -88,10 +88,9 @@ vk_common_DestroyDebugReportCallbackEXT(VkInstance _instance,
    /* Remove from list and destroy given callback. */
    mtx_lock(&instance->debug_report.callbacks_mutex);
    list_del(&callback->link);
+   vk_object_base_finish(&callback->base);
    vk_free2(&instance->alloc, pAllocator, callback);
    mtx_unlock(&instance->debug_report.callbacks_mutex);
-
-   vk_object_base_finish(&callback->base);
 }
 
 static void