Mesa (staging/21.3): zink: Do not access just freed zink_batch_state

[GitLab Mirror]

Module: Mesa
Branch: staging/21.3
Commit: d7d953045b45370413f897abb2eda7414a587b43
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=d7d953045b45370413f897abb2eda7414a587b43

Author: Witold Baryluk <baryluk at smp.if.uj.edu.pl>
Date:   Fri Oct 15 00:29:47 2021 +0200

zink: Do not access just freed zink_batch_state

Cc: mesa-stable
Reviewed-by: Mike Blumenkrantz <michael.blumenkrantz at gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13370>
(cherry picked from commit 4d777631b595075169830a63b4281e9f0cbb45be)

---

 .pick_status.json                       | 2 +-
 src/gallium/drivers/zink/zink_context.c | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 2ac96f14a84..9c37ebd5e36 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -679,7 +679,7 @@
         "description": "zink: Do not access just freed zink_batch_state",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": null
     },
diff --git a/src/gallium/drivers/zink/zink_context.c b/src/gallium/drivers/zink/zink_context.c
index 536268255b7..826ae3ce5fd 100644
--- a/src/gallium/drivers/zink/zink_context.c
+++ b/src/gallium/drivers/zink/zink_context.c
@@ -105,9 +105,12 @@ zink_context_destroy(struct pipe_context *pctx)
    simple_mtx_destroy(&ctx->batch_mtx);
    zink_clear_batch_state(ctx, ctx->batch.state);
    zink_batch_state_destroy(screen, ctx->batch.state);
-   for (struct zink_batch_state *bs = ctx->batch_states; bs; bs = bs->next) {
+   struct zink_batch_state *bs = ctx->batch_states;
+   while (bs) {
+      struct zink_batch_state *bs_next = bs->next;
       zink_clear_batch_state(ctx, bs);
       zink_batch_state_destroy(screen, bs);
+      bs = bs_next;
    }
    util_dynarray_foreach(&ctx->free_batch_states, struct zink_batch_state*, bs) {
       zink_clear_batch_state(ctx, *bs);