| Summary: | Gallium: use after free with transform feedback | ||
|---|---|---|---|
| Product: | Mesa | Reporter: | Gert Wollny <gw.fossdev> |
| Component: | Other | Assignee: | mesa-dev |
| Status: | RESOLVED FIXED | QA Contact: | mesa-dev |
| Severity: | normal | ||
| Priority: | medium | ||
| Version: | git | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
I'll send a patch shortly. This was fixed in upstream and 18.2.6. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
With the call sequence eglMakeCurrent(Y) glUseProgram(X) glBindTransformFeedback(..., 1) /*do something*/ glBindTransformFeedback(..., 0) eglMakeCurrent(Y) glDeleteProgram(X) glBindTransformFeedback(..., 1) glEndTransformFeedback() there is a use after free in glEndTransformFeedback(): #0 0x7f93bfecfda1 in st_end_transform_feedback mesa/state_tracker/st_cb_xformfb.c:206 #1 0x7f93bf84fecc in end_transform_feedback mesa/main/transformfeedback.c:505 #2 0x7f93bf8500d7 in _mesa_EndTransformFeedback mesa/main/transformfeedback.c:535 because the transform feedback holds a stale link to the shader program. I've seen this error on r600 and it was also confirmed on radeonsi, the same code runs fine with i965. That spec says "If a program object is in use as part of current rendering state, it will be flagged for deletion, but it will not be deleted until it is no longer part of current state for any rendering context." So since the shader program is part of the current rendering state it should still be available. I am however not completely sure about this, because the transform feedback object was not bound when the program was deleted, so maybe the deleted program should not be part of its state. So either the shader gets deleted too early, or the transform feedback object is not properly notified about the shader being deleted.