[Mesa-dev] [PATCH] gallium/vbuf: fix buffer reference bugs

[Marek Olšák]

Reviewed-by: Marek Olšák <marek.olsak at amd.com>

Marek

On Thu, Aug 24, 2017 at 6:48 PM, Brian Paul <brianp at vmware.com> wrote:
> In two places we called pipe_resource_reference() to remove a reference
> to a vertex buffer resource.  But we neglected to check if the buffer was
> a user buffer and not a pipe_resource.  This caused us to pass an invalid
> pipe_resource pointer to pipe_resource_reference().
>
> Instead of calling pipe_resource_reference(&vbuf->resource, NULL), use
> pipe_vertex_buffer_unreference(&vbuf) which checks the is_user_buffer
> field and does the right thing.
>
> Also, explicity set the is_user_buffer field to false after setting the
> vbuf->resource pointer to out_buffer.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102377
> ---
>  src/gallium/auxiliary/util/u_vbuf.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/src/gallium/auxiliary/util/u_vbuf.c b/src/gallium/auxiliary/util/u_vbuf.c
> index 6dc8bc7..80c30ac 100644
> --- a/src/gallium/auxiliary/util/u_vbuf.c
> +++ b/src/gallium/auxiliary/util/u_vbuf.c
> @@ -513,9 +513,9 @@ u_vbuf_translate_buffers(struct u_vbuf *mgr, struct translate_key *key,
>     mgr->real_vertex_buffer[out_vb].stride = key->output_stride;
>
>     /* Move the buffer reference. */
> -   pipe_resource_reference(
> -      &mgr->real_vertex_buffer[out_vb].buffer.resource, NULL);
> +   pipe_vertex_buffer_unreference(&mgr->real_vertex_buffer[out_vb]);
>     mgr->real_vertex_buffer[out_vb].buffer.resource = out_buffer;
> +   mgr->real_vertex_buffer[out_vb].is_user_buffer = false;
>
>     return PIPE_OK;
>  }
> @@ -833,8 +833,7 @@ void u_vbuf_set_vertex_buffers(struct u_vbuf *mgr,
>           unsigned dst_index = start_slot + i;
>
>           pipe_vertex_buffer_unreference(&mgr->vertex_buffer[dst_index]);
> -         pipe_resource_reference(&mgr->real_vertex_buffer[dst_index].buffer.resource,
> -                                 NULL);
> +         pipe_vertex_buffer_unreference(&mgr->real_vertex_buffer[dst_index]);
>        }
>
>        pipe->set_vertex_buffers(pipe, start_slot, count, NULL);
> --
> 1.9.1
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev