[Spice-devel] [PATCH] qxl:fix double free surface when create device bitmap failed

[Alon Levy]

On Thu, Dec 09, 2010 at 04:25:24PM +0800, Coolper Chen wrote:
> I'm using qxl master.
> 
> GetSurfaceInfo(pdev, surface_id)->u.pdev = pdev;
> 
> QXLGetSurface(pdev, phys_mem, size.cx, size.cy, depth,
>               &stride, base_mem, allocation_type);
> if (!*base_mem) {
>    //it executes "goto out_error2" in my windows xp guest.
>    goto out_error2;
> }

(sorry for the double mails), to put it another way - are you
certain the FreeSurface doesn't happen in QXLGetSurface maybe or
any other location after EngCreateDeviceBitmap succeeds and prior
to goto out_error2?

> 
> On Thu, 2010-12-09 at 16:15 +0800, Alon Levy wrote:
> > On Thu, Dec 09, 2010 at 09:07:23AM +0800, Coolper Chen wrote:
> > > DrvCreateDeviceBitmap will call FreeSurface function when
> > > CreateDeviceBitmap failed, no need call FreeSurface function in
> > > CreateDeviceBitmap function;
> > > It fixes the windows XP bluescreen problem that I encounter.
> > > 
> > > diff --git a/display/surface.c b/display/surface.c
> > > index 7146b32..38200aa 100644
> > > --- a/display/surface.c
> > > +++ b/display/surface.c
> > > @@ -152,7 +152,6 @@ HBITMAP CreateDeviceBitmap(PDev *pdev, SIZEL size,
> > > ULONG format, QXLPHYSICAL *ph
> > >  out_error3:
> > >      QXLDelSurface(pdev, *base_mem, allocation_type);
> > >  out_error2:
> > > -    FreeSurface(pdev, surface_id);
> > >      EngDeleteSurface((HSURF)surf);
> > >  out_error1:
> > >      return 0;
> > > 
> > 
> > Just to be clear, I realize it fixes your bsod, but It seems perhaps that
> > the free is being done elsewhere - maybe EngAssociateSurface if it fails
> > frees the surface?
> > 
> > > /Coolper Chen
> > > 
> > > _______________________________________________
> > > Spice-devel mailing list
> > > Spice-devel at lists.freedesktop.org
> > > http://lists.freedesktop.org/mailman/listinfo/spice-devel
> 
>