[Mesa-dev] [RFC PATCH 45/65] st/mesa: do not release sampler views for resident textures

[Samuel Pitoiset]

On 05/23/2017 10:11 PM, Marek Olšák wrote:
> I don't think this change is necessary. Releasing sampler views
> doesn't release textures.

This issued has been reported by Feral directly. It happens in the 
following scenario:

1) create a texture
2) get a texture handle
3) make it resident
4) bind the texture to a unit
5) draw

The sampler views are then released and this ended up with a 
use-after-free at decompression time for the resident texture handle.

> 
> Marek
> 
> On Fri, May 19, 2017 at 6:52 PM, Samuel Pitoiset
> <samuel.pitoiset at gmail.com> wrote:
>> When a texture is referenced by one or more texture handles,
>> it might be resident and we shouldn't release the sampler views.
>>
>> Signed-off-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
>> ---
>>   src/mesa/state_tracker/st_sampler_view.c | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/src/mesa/state_tracker/st_sampler_view.c b/src/mesa/state_tracker/st_sampler_view.c
>> index c78a987486..690b50087c 100644
>> --- a/src/mesa/state_tracker/st_sampler_view.c
>> +++ b/src/mesa/state_tracker/st_sampler_view.c
>> @@ -115,6 +115,12 @@ st_texture_release_all_sampler_views(struct st_context *st,
>>   {
>>      GLuint i;
>>
>> +   if (stObj->base.HandleAllocated) {
>> +      /* Do not release sampler views when a texture is referenced by one or
>> +       * more texture handles because the texture might be resident. */
>> +      return;
>> +   }
>> +
>>      /* XXX This should use sampler_views[i]->pipe, not st->pipe */
>>      for (i = 0; i < stObj->num_sampler_views; ++i)
>>         pipe_sampler_view_release(st->pipe, &stObj->sampler_views[i]);
>> --
>> 2.13.0
>>
>> _______________________________________________
>> mesa-dev mailing list
>> mesa-dev at lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/mesa-dev