[Mesa-dev] svga shader variant frees

Dave Airlie airlied at gmail.com
Thu Oct 4 23:54:14 UTC 2018


Coverity pointed out a problem with svga_destroy_shader_variant, and
the functions that call it twice.

      ret = svga_destroy_shader_variant(svga, SVGA3D_SHADERTYPE_VS, variant);
      if (ret != PIPE_OK) {
         svga_context_flush(svga, NULL);
         ret = svga_destroy_shader_variant(svga, SVGA3D_SHADERTYPE_VS, variant);
         assert(ret == PIPE_OK);

now svga_destroy_shader_variant always free variant no matter what, so
this is effectively a double free.

I'm not sure the best way to fix it, but svga might do it.

Dave.


More information about the mesa-dev mailing list