[Mesa-dev] [PATCH 1/1] r600: Fix use after free in compute_memory_promote_item.

[Jan Vesely]

On Mon, 2014-06-23 at 17:15 +0200, Bruno Jimenez wrote:
> On Mon, 2014-06-23 at 10:39 -0400, Jan Vesely wrote:
> > The dst pointer needs to be initialized after any calls to
> >  compute_memory_grow_pool, as the function might change the pool->vbo pointer.
> 
> You are completely right. Good catch.
> 
> Reviewed-by: Bruno Jiménez <brunojimen at gmail.com>

Thanks for review, now we just need a volunteer to push this...

> Sorry for any inconvenience this may have caused.

no worries, none caused

> 
> > This fixes crashes and assertion failures in two gegl tests.
> > 
> > Signed-off-by: Jan Vesely <jan.vesely at rutgers.edu>
> > CC: Bruno Jimenez <brunojimen at gmail.com>
> > CC: Tom Stellard <thomas.stellard at amd.com>
> > ---
> >  src/gallium/drivers/r600/compute_memory_pool.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/src/gallium/drivers/r600/compute_memory_pool.c b/src/gallium/drivers/r600/compute_memory_pool.c
> > index a78ff1e..9cb16f8 100644
> > --- a/src/gallium/drivers/r600/compute_memory_pool.c
> > +++ b/src/gallium/drivers/r600/compute_memory_pool.c
> > @@ -308,8 +308,8 @@ int compute_memory_promote_item(struct compute_memory_pool *pool,
> >  {
> >  	struct pipe_screen *screen = (struct pipe_screen *)pool->screen;
> >  	struct r600_context *rctx = (struct r600_context *)pipe;
> > -	struct pipe_resource *dst = (struct pipe_resource *)pool->bo;
> >  	struct pipe_resource *src = (struct pipe_resource *)item->real_buffer;
> > +	struct pipe_resource *dst = NULL;
> >  	struct pipe_box box;
> >  
> >  	struct list_head *pos;
> > @@ -339,6 +339,7 @@ int compute_memory_promote_item(struct compute_memory_pool *pool,
> >  		if (err == -1)
> >  			return -1;
> >  	}
> > +	dst = (struct pipe_resource *)pool->bo;
> >  	COMPUTE_DBG(pool->screen, "  + Found space for Item %p id = %u "
> >  			"start_in_dw = %u (%u bytes) size_in_dw = %u (%u bytes)\n",
> >  			item, item->id, start_in_dw, start_in_dw * 4,
> 
> 

-- 
Jan Vesely <jan.vesely at rutgers.edu>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freedesktop.org/archives/mesa-dev/attachments/20140624/0edf0410/attachment.sig>