[Mesa-dev] [PATCH v2] dri3: Prevent multiple freeing of buffers.

[Sergii Romantsov]

Commit 3160cb86aa92 adds optimization with flag 'reallocate'.
Processing of flag causes buffers freeing while pointer
is still hold in caller stack and than again used to be freed.

Fixes: 3160cb86aa92 "egl/x11: Re-allocate buffers if format is suboptimal"

v2:
 used flag 'busy' instead of introducing new one.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105906
Signed-off-by: Sergii Romantsov <sergii.romantsov at globallogic.com>
Tested-by: Andriy Khulap <andriy.khulap at globallogic.com>
---
 src/loader/loader_dri3_helper.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/loader/loader_dri3_helper.c b/src/loader/loader_dri3_helper.c
index fe17df1..a934db1 100644
--- a/src/loader/loader_dri3_helper.c
+++ b/src/loader/loader_dri3_helper.c
@@ -1688,6 +1688,7 @@ dri3_get_buffer(__DRIdrawable *driDrawable,
            (buffer_type == loader_dri3_buffer_front && draw->have_fake_front))
           && buffer) {
 
+         buffer->busy = true;
          /* Fill the new buffer with data from an old buffer */
          dri3_fence_await(draw->conn, draw, buffer);
          if (!loader_dri3_blit_image(draw,
@@ -1731,6 +1732,7 @@ dri3_get_buffer(__DRIdrawable *driDrawable,
       draw->buffers[buf_id] = buffer;
    }
    dri3_fence_await(draw->conn, draw, buffer);
+   buffer = draw->buffers[buf_id];
 
    /*
     * Do we need to preserve the content of a previous buffer?
@@ -1744,7 +1746,8 @@ dri3_get_buffer(__DRIdrawable *driDrawable,
    if (buffer_type == loader_dri3_buffer_back &&
        draw->cur_blit_source != -1 &&
        draw->buffers[draw->cur_blit_source] &&
-       buffer != draw->buffers[draw->cur_blit_source]) {
+       buffer != draw->buffers[draw->cur_blit_source] &&
+       buffer != NULL) {
 
       struct loader_dri3_buffer *source = draw->buffers[draw->cur_blit_source];
 
-- 
2.7.4