zink: fix descriptor buffer unmaps on screen destroy
descriptor buffer uses mapped buffers. mapping/unmapping buffers
uses a ctx in the function params, but at this time there is no ctx.
since the ctx is not actually used for unmapping descriptor buffers,
this can instead use a special buffer unmap function to avoid invalid access
Fixes: b06f6e00fb ("zink: fix heap-use-after-free on batch_state with sub-allocated pipe_resources")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27344>
This commit is contained in:
committed by
Marge Bot
parent
c900cca96c
commit
0a97d1ebfa
@@ -173,6 +173,7 @@ zink_context_destroy(struct pipe_context *pctx)
|
||||
while (bs) {
|
||||
struct zink_batch_state *bs_next = bs->next;
|
||||
zink_clear_batch_state(ctx, bs);
|
||||
bs->ctx = NULL;
|
||||
/* restore link as we insert them into the screens free_batch_states
|
||||
* list below
|
||||
*/
|
||||
|
||||
@@ -1501,7 +1501,7 @@ zink_batch_descriptor_deinit(struct zink_screen *screen, struct zink_batch_state
|
||||
}
|
||||
|
||||
if (bs->dd.db_xfer)
|
||||
pipe_buffer_unmap(&bs->ctx->base, bs->dd.db_xfer);
|
||||
zink_screen_buffer_unmap(&screen->base, bs->dd.db_xfer);
|
||||
bs->dd.db_xfer = NULL;
|
||||
if (bs->dd.db)
|
||||
screen->base.resource_destroy(&screen->base, &bs->dd.db->base.b);
|
||||
|
||||
@@ -2985,6 +2985,16 @@ do_transfer_unmap(struct zink_screen *screen, struct zink_transfer *trans)
|
||||
unmap_resource(screen, res);
|
||||
}
|
||||
|
||||
void
|
||||
zink_screen_buffer_unmap(struct pipe_screen *pscreen, struct pipe_transfer *ptrans)
|
||||
{
|
||||
struct zink_screen *screen = zink_screen(pscreen);
|
||||
struct zink_transfer *trans = (struct zink_transfer *)ptrans;
|
||||
if (trans->base.b.usage & PIPE_MAP_ONCE && !trans->staging_res)
|
||||
do_transfer_unmap(screen, trans);
|
||||
transfer_unmap(NULL, ptrans);
|
||||
}
|
||||
|
||||
static void
|
||||
zink_buffer_unmap(struct pipe_context *pctx, struct pipe_transfer *ptrans)
|
||||
{
|
||||
|
||||
@@ -44,7 +44,8 @@ zink_screen_resource_init(struct pipe_screen *pscreen);
|
||||
|
||||
void
|
||||
zink_context_resource_init(struct pipe_context *pctx);
|
||||
|
||||
void
|
||||
zink_screen_buffer_unmap(struct pipe_screen *pscreen, struct pipe_transfer *ptrans);
|
||||
void
|
||||
zink_get_depth_stencil_resources(struct pipe_resource *res,
|
||||
struct zink_resource **out_z,
|
||||
|
||||
Reference in New Issue
Block a user