[Mesa-dev] [RFC PATCH 45/65] st/mesa: do not release sampler views for resident textures

[Marek Olšák]

On Wed, May 24, 2017 at 10:50 AM, Samuel Pitoiset
<samuel.pitoiset at gmail.com> wrote:
>
>
> On 05/23/2017 10:11 PM, Marek Olšák wrote:
>>
>> I don't think this change is necessary. Releasing sampler views
>> doesn't release textures.
>
>
> This issued has been reported by Feral directly. It happens in the following
> scenario:
>
> 1) create a texture
> 2) get a texture handle
> 3) make it resident
> 4) bind the texture to a unit
> 5) draw
>
> The sampler views are then released and this ended up with a use-after-free
> at decompression time for the resident texture handle.

It seems that you keep a pointer to some object that is released by
releasing sampler views. You need to increment the reference counter
for that object, so that releasing sampler views won't release the
object.

Marek

>
>
>>
>> Marek
>>
>> On Fri, May 19, 2017 at 6:52 PM, Samuel Pitoiset
>> <samuel.pitoiset at gmail.com> wrote:
>>>
>>> When a texture is referenced by one or more texture handles,
>>> it might be resident and we shouldn't release the sampler views.
>>>
>>> Signed-off-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
>>> ---
>>>   src/mesa/state_tracker/st_sampler_view.c | 6 ++++++
>>>   1 file changed, 6 insertions(+)
>>>
>>> diff --git a/src/mesa/state_tracker/st_sampler_view.c
>>> b/src/mesa/state_tracker/st_sampler_view.c
>>> index c78a987486..690b50087c 100644
>>> --- a/src/mesa/state_tracker/st_sampler_view.c
>>> +++ b/src/mesa/state_tracker/st_sampler_view.c
>>> @@ -115,6 +115,12 @@ st_texture_release_all_sampler_views(struct
>>> st_context *st,
>>>   {
>>>      GLuint i;
>>>
>>> +   if (stObj->base.HandleAllocated) {
>>> +      /* Do not release sampler views when a texture is referenced by
>>> one or
>>> +       * more texture handles because the texture might be resident. */
>>> +      return;
>>> +   }
>>> +
>>>      /* XXX This should use sampler_views[i]->pipe, not st->pipe */
>>>      for (i = 0; i < stObj->num_sampler_views; ++i)
>>>         pipe_sampler_view_release(st->pipe, &stObj->sampler_views[i]);
>>> --
>>> 2.13.0
>>>
>>> _______________________________________________
>>> mesa-dev mailing list
>>> mesa-dev at lists.freedesktop.org
>>> https://lists.freedesktop.org/mailman/listinfo/mesa-dev