AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iris: avoid use after free in shader destruction

Browse Source 
While playing with compute shaders, I was getting a random crash,
noticed that bind_state was using the old shader info for comparision,
but gallium allows the shader to be deleted while bound, so this could
lead to a use after free.

This can't happen using the cso cache. As it tracks all of this.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
This commit is contained in:
Dave Airlie
2019-04-04 11:18:26 +10:00
parent 42f63e6334
commit 0ea386128b
1 changed files with 49 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gallium/drivers/iris/iris_program.c
+49 -7
View File
@@ -1620,14 +1620,56 @@ iris_create_compute_state(struct pipe_context *ctx,
* Frees the iris_uncompiled_shader.
*/
static void
iris_delete_shader_state(struct pipe_context *ctx, void *state)
iris_delete_shader_state(struct pipe_context *ctx, void *state, gl_shader_stage stage)
{
struct iris_uncompiled_shader *ish = state;
struct iris_context *ice = (void *) ctx;
if (ice->shaders.uncompiled[stage] == ish) {
ice->shaders.uncompiled[stage] = NULL;
ice->state.dirty |= IRIS_DIRTY_UNCOMPILED_VS << stage;
}
ralloc_free(ish->nir);
free(ish);
}
static void
iris_delete_vs_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_VERTEX);
}
static void
iris_delete_tcs_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_TESS_CTRL);
}
static void
iris_delete_tes_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_TESS_EVAL);
}
static void
iris_delete_gs_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_GEOMETRY);
}
static void
iris_delete_fs_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_FRAGMENT);
}
static void
iris_delete_cs_state(struct pipe_context *ctx, void *state)
{
iris_delete_shader_state(ctx, state, MESA_SHADER_COMPUTE);
}
/**
* The pipe->bind_[stage]_state() driver hook.
*
@@ -1737,12 +1779,12 @@ iris_init_program_functions(struct pipe_context *ctx)
ctx->create_fs_state = iris_create_fs_state;
ctx->create_compute_state = iris_create_compute_state;
ctx->delete_vs_state = iris_delete_shader_state;
ctx->delete_tcs_state = iris_delete_shader_state;
ctx->delete_tes_state = iris_delete_shader_state;
ctx->delete_gs_state = iris_delete_shader_state;
ctx->delete_fs_state = iris_delete_shader_state;
ctx->delete_compute_state = iris_delete_shader_state;
ctx->delete_vs_state = iris_delete_vs_state;
ctx->delete_tcs_state = iris_delete_tcs_state;
ctx->delete_tes_state = iris_delete_tes_state;
ctx->delete_gs_state = iris_delete_gs_state;
ctx->delete_fs_state = iris_delete_fs_state;
ctx->delete_compute_state = iris_delete_cs_state;
ctx->bind_vs_state = iris_bind_vs_state;
ctx->bind_tcs_state = iris_bind_tcs_state;