<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Gallium: use after free with transform feedback"
href="https://bugs.freedesktop.org/show_bug.cgi?id=108713">108713</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Gallium: use after free with transform feedback
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr>
<tr>
<th>Version</th>
<td>git
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>Other
</td>
</tr>
<tr>
<th>Assignee</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>gw.fossdev@gmail.com
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr></table>
<p>
<div>
<pre>With the call sequence
eglMakeCurrent(Y)
glUseProgram(X)
glBindTransformFeedback(..., 1)
/*do something*/
glBindTransformFeedback(..., 0)
eglMakeCurrent(Y)
glDeleteProgram(X)
glBindTransformFeedback(..., 1)
glEndTransformFeedback()
there is a use after free in glEndTransformFeedback():
#0 0x7f93bfecfda1 in st_end_transform_feedback
mesa/state_tracker/st_cb_xformfb.c:206
#1 0x7f93bf84fecc in end_transform_feedback
mesa/main/transformfeedback.c:505
#2 0x7f93bf8500d7 in _mesa_EndTransformFeedback
mesa/main/transformfeedback.c:535
because the transform feedback holds a stale link to the shader program.
I've seen this error on r600 and it was also confirmed on radeonsi, the same
code runs fine with i965.
That spec says
"If a program object is in use as part of current rendering state, it will be
flagged for deletion, but it will not be deleted until it is no longer part of
current state for any rendering context."
So since the shader program is part of the current rendering state it should
still be available.
I am however not completely sure about this, because the transform feedback
object was not bound when the program was deleted, so maybe the deleted program
should not be part of its state.
So either the shader gets deleted too early, or the transform feedback object
is not properly notified about the shader being deleted.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>