[Mesa-dev] [RFC 1/7] st/dri: fix double free of dri_drawable

Chih-Wei Huang cwhuang at android-x86.org
Thu Apr 28 07:34:54 UTC 2016


From: WuZhen <wuzhen at jidemail.com>

In the callchain destroy_surface->destroyDrawable->dri_put_drawable->
dri_put_drawable->DestroyBuffer

By the semantic of it, dri_destroy_buffer should not free drawable struct,
all vendor specific and legacy swrast version of the function do not.
wonder why no body else ran into this.

NO_REF_TASK
tested: local run

Change-Id: Ibe82d82d2e34b162e64bf0b8805f8a4553d362d5
Signed-off-by: Chih-Wei Huang <cwhuang at linux.org.tw>
---
 src/gallium/state_trackers/dri/dri_drawable.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/gallium/state_trackers/dri/dri_drawable.c b/src/gallium/state_trackers/dri/dri_drawable.c
index adc5128..c72335b 100644
--- a/src/gallium/state_trackers/dri/dri_drawable.c
+++ b/src/gallium/state_trackers/dri/dri_drawable.c
@@ -176,8 +176,6 @@ dri_destroy_buffer(__DRIdrawable * dPriv)
       pipe_resource_reference(&drawable->msaa_textures[i], NULL);
 
    swap_fences_unref(drawable);
-
-   FREE(drawable);
 }
 
 /**
-- 
1.9.1



More information about the mesa-dev mailing list