From 79ce0e3b2fc5559df03f880ce299443a77002e98 Mon Sep 17 00:00:00 2001 From: David Rosca Date: Thu, 8 Aug 2024 08:59:13 +0200 Subject: [PATCH] frontends/va: Fix use after free with EFC This happens when the source surface is destroyed before being used in encoding operation. It also needs to disable EFC in this case. Fixes: a7469a9ffd3 ("frontends/va: Rework EFC logic") Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/11653 Reviewed-by: Ruijing Dong Part-of: --- src/gallium/frontends/va/surface.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/gallium/frontends/va/surface.c b/src/gallium/frontends/va/surface.c index 48aeea503e3..1abbecf3525 100644 --- a/src/gallium/frontends/va/surface.c +++ b/src/gallium/frontends/va/surface.c @@ -92,8 +92,14 @@ vlVaDestroySurfaces(VADriverContextP ctx, VASurfaceID *surface_list, int num_sur if (surf->fence && surf->ctx->decoder && surf->ctx->decoder->destroy_fence) surf->ctx->decoder->destroy_fence(surf->ctx->decoder, surf->fence); } - if (drv->last_efc_surface == surf) - drv->last_efc_surface = NULL; + if (drv->last_efc_surface) { + vlVaSurface *efc_surf = drv->last_efc_surface; + if (efc_surf == surf || efc_surf->efc_surface == surf) { + efc_surf->efc_surface = NULL; + drv->last_efc_surface = NULL; + drv->efc_count = -1; + } + } util_dynarray_fini(&surf->subpics); FREE(surf); handle_table_remove(drv->htab, surface_list[i]);