Mesa (main): zink: Do not access just freed zink_batch_state

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: 4d777631b595075169830a63b4281e9f0cbb45be
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=4d777631b595075169830a63b4281e9f0cbb45be

Author: Witold Baryluk <baryluk at smp.if.uj.edu.pl>
Date:   Fri Oct 15 00:29:47 2021 +0200

zink: Do not access just freed zink_batch_state

Cc: mesa-stable
Reviewed-by: Mike Blumenkrantz <michael.blumenkrantz at gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13370>

---

 src/gallium/drivers/zink/zink_context.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/gallium/drivers/zink/zink_context.c b/src/gallium/drivers/zink/zink_context.c
index 536268255b7..826ae3ce5fd 100644
--- a/src/gallium/drivers/zink/zink_context.c
+++ b/src/gallium/drivers/zink/zink_context.c
@@ -105,9 +105,12 @@ zink_context_destroy(struct pipe_context *pctx)
    simple_mtx_destroy(&ctx->batch_mtx);
    zink_clear_batch_state(ctx, ctx->batch.state);
    zink_batch_state_destroy(screen, ctx->batch.state);
-   for (struct zink_batch_state *bs = ctx->batch_states; bs; bs = bs->next) {
+   struct zink_batch_state *bs = ctx->batch_states;
+   while (bs) {
+      struct zink_batch_state *bs_next = bs->next;
       zink_clear_batch_state(ctx, bs);
       zink_batch_state_destroy(screen, bs);
+      bs = bs_next;
    }
    util_dynarray_foreach(&ctx->free_batch_states, struct zink_batch_state*, bs) {
       zink_clear_batch_state(ctx, *bs);