Mesa (main): radeonsi: Check aux_context on si_destroy_screen()

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: 5bfd1a7e19ec1c510c2ba4adadad98d78f712eaf
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=5bfd1a7e19ec1c510c2ba4adadad98d78f712eaf

Author: Olivier Fourdan <ofourdan at redhat.com>
Date:   Mon Jul 19 09:29:46 2021 +0200

radeonsi: Check aux_context on si_destroy_screen()

The function radeonsi_screen_create_impl() tries to create the
aux_context but doesn't actually check for the returned value from
si_create_context().

Then, on si_destroy_screen() the aux_context is used without actually
checking whether it's a thing or not.

As a result, if for any reason si_create_context() failed, we shall
crash in si_destroy_screen() with a NULL pointer dereference trying to
access ((struct si_context *)sscreen->aux_context)->log.

Simply check for aux_context not being NULL to avoid that crash.

Cc: mesa-stable
Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
Reviewed-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer at amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/11948>

---

 src/gallium/drivers/radeonsi/si_pipe.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/gallium/drivers/radeonsi/si_pipe.c b/src/gallium/drivers/radeonsi/si_pipe.c
index 95b4a71873e..f768d3085f9 100644
--- a/src/gallium/drivers/radeonsi/si_pipe.c
+++ b/src/gallium/drivers/radeonsi/si_pipe.c
@@ -862,15 +862,17 @@ static void si_destroy_screen(struct pipe_screen *pscreen)
 
    simple_mtx_destroy(&sscreen->aux_context_lock);
 
-   struct u_log_context *aux_log = ((struct si_context *)sscreen->aux_context)->log;
-   if (aux_log) {
-      sscreen->aux_context->set_log_context(sscreen->aux_context, NULL);
-      u_log_context_destroy(aux_log);
-      FREE(aux_log);
+   if (sscreen->aux_context) {
+       struct u_log_context *aux_log = ((struct si_context *)sscreen->aux_context)->log;
+       if (aux_log) {
+          sscreen->aux_context->set_log_context(sscreen->aux_context, NULL);
+          u_log_context_destroy(aux_log);
+          FREE(aux_log);
+       }
+
+       sscreen->aux_context->destroy(sscreen->aux_context);
    }
 
-   sscreen->aux_context->destroy(sscreen->aux_context);
-
    util_queue_destroy(&sscreen->shader_compiler_queue);
    util_queue_destroy(&sscreen->shader_compiler_queue_low_priority);