From 2a381bbc3cec1a54095cf4a51df8516d25207fe4 Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Thu, 17 Apr 2025 10:04:24 +0200 Subject: [PATCH] radeonsi: fix potential use after free in si_set_debug_callback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit si_destroy_context needs to call context->set_debug_callback(...) to avoid the debug logs to access the destroyed context. Adding this change introduced a different problem: when an aux context is destroyed from si_destroy_screen, parts of the screen have been freed already: the shader_compiler_queue_*. c467a87e06e ("radeonsi: Destroy queues before the aux contexts") moved the util_queue_destroy calls above the context destruction, but with the 59a3f38ff6f change, it's not needed anymore: si_destroy_context will finish the screen shader queues before proceeding with releasing, so use-after-free isn't possible. Fixes: 59a3f38ff6f ("radeonsi: clear the debug callback on ctx destroy") Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/12035 Reviewed-by: Marek Olšák Part-of: --- src/gallium/drivers/radeonsi/si_pipe.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/gallium/drivers/radeonsi/si_pipe.c b/src/gallium/drivers/radeonsi/si_pipe.c index 4580fa4a919..1472830079f 100644 --- a/src/gallium/drivers/radeonsi/si_pipe.c +++ b/src/gallium/drivers/radeonsi/si_pipe.c @@ -1016,9 +1016,6 @@ void si_destroy_screen(struct pipe_screen *pscreen) pipe_resource_reference(&sscreen->tess_rings, NULL); pipe_resource_reference(&sscreen->tess_rings_tmz, NULL); - util_queue_destroy(&sscreen->shader_compiler_queue); - util_queue_destroy(&sscreen->shader_compiler_queue_opt_variants); - for (unsigned i = 0; i < ARRAY_SIZE(sscreen->aux_contexts); i++) { if (!sscreen->aux_contexts[i].ctx) continue; @@ -1036,6 +1033,9 @@ void si_destroy_screen(struct pipe_screen *pscreen) mtx_destroy(&sscreen->aux_contexts[i].lock); } + util_queue_destroy(&sscreen->shader_compiler_queue); + util_queue_destroy(&sscreen->shader_compiler_queue_opt_variants); + simple_mtx_destroy(&sscreen->async_compute_context_lock); if (sscreen->async_compute_context) { sscreen->async_compute_context->destroy(sscreen->async_compute_context);