Module: Mesa Branch: master Commit: d3c67d7e7ec6b9cf10fbea0d08e92751b7b0fbae URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=d3c67d7e7ec6b9cf10fbea0d08e92751b7b0fbae
Author: Eric Anholt <[email protected]> Date: Tue Dec 1 13:47:28 2020 -0800 freedreno: Break out of "should we free the entry" loop once we've freed. Fixes a use-after-free of the state on the next iteration when it was probably just destroyed. Fixes: 6de01faac5a2 ("freedreno/a6xx: invalidate tex state cache entries on rebind") Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/7695> --- src/gallium/drivers/freedreno/a6xx/fd6_texture.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/gallium/drivers/freedreno/a6xx/fd6_texture.c b/src/gallium/drivers/freedreno/a6xx/fd6_texture.c index 7c555968eaf..84f16366cae 100644 --- a/src/gallium/drivers/freedreno/a6xx/fd6_texture.c +++ b/src/gallium/drivers/freedreno/a6xx/fd6_texture.c @@ -512,6 +512,7 @@ fd6_rebind_resource(struct fd_context *ctx, struct fd_resource *rsc) for (unsigned i = 0; i < ARRAY_SIZE(state->key.view); i++) { if (rsc->seqno == state->key.view[i].rsc_seqno) { remove_tex_entry(fd6_ctx, entry); + break; } } } _______________________________________________ mesa-commit mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/mesa-commit
