[Mesa-dev] [PATCH] st/dri: Fix dangling pointer to a destroyed dri_drawable

[Michel Dänzer]

Please don't top-post.


On 2018-04-24 10:44 AM, Johan Helsing wrote:
> If the call to dri_destroy_buffer is delayed until the next eglMakeCurrent,
> that would also solve the problem (I'm not sure how that would affect other
> things, though).

Looking at the EGL spec, section 3.5.5 "Destroying Rendering Surfaces"
says about eglDestroySurface:

 All resources associated with surface which were allocated by EGL are
 marked for deletion as soon as possible.

And section 3.7.4 "Context Queries" says:

 If a current surface has been marked for deletion as a result of
 calling eglTerminate or eglDestroySurface, the handle returned by
 eglGetCurrentSurface is not valid, and cannot be passed successfully to
 any other EGL function, [...]

And in appendix E.1 "Updates to EGL 1.4":

 Changes in the revision approved on January 20, 2009:

 • Change object destruction behavior such that object handles become
   invalid immediately after an object is deleted, although the
   underlying object may remain valid if it’s current to a context.

It seems clear from this language that the surface isn't supposed to be
actually destroyed as long as it's current to the context. However, I'm
not sure offhand what needs to be done at which level to achieve that.


> ________________________________
> From: Michel Dänzer <michel at daenzer.net>
> Sent: Tuesday, April 24, 2018 10:36:00 AM
> To: Johan Helsing; Marek Olšák
> Cc: Daniel Stone; pekka.paalanen at collabora.co.uk; ML Mesa-dev
> Subject: Re: [Mesa-dev] [PATCH] st/dri: Fix dangling pointer to a destroyed dri_drawable
> 
> On 2018-04-24 09:13 AM, Johan Helsing wrote:
>> Emil: Your alternative patch won't work because dri_make_current is not necessarily called with NULL after a buffer has been destroyed.
>>
>>
>> The problematic sequence is a pattern we use in QtWayland:
>>
>>
>> //create temporary context
>>
>> surface1 = eglCreateWindowSurface() <-- dri_drawable pointer is malloced
>>
>> eglMakeCurrent(surface1) <-- ctx->dPriv is set
>>
>>
>> // ... (Get some information about available GL extensions etc)
>>
>>
>> eglDestroySurface(surface1) <-- pointer is freed, ctx->dPriv is now dangling
> 
> Is this the problem? The memory pointed to by ctx->dPriv shouldn't be
> freed as long as the surface is bound to the current context?
> 
> 
> --
> Earthling Michel Dänzer               |               http://www.amd.com
> Libre software enthusiast             |             Mesa and X developer
> 
> 
> 
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
> 


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer