Bug 75335

Summary: Use of uninitialized pointer in 'gallium_screen_create()'
Product: Mesa Reporter: Christian Prochaska <christian.prochaska>
Component: OtherAssignee: mesa-dev
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: git   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: targets/gbm: exit gracefully if pipe_loader_drm_probe_fd is not available

Description Christian Prochaska 2014-02-21 18:42:06 UTC
(git master 9b2fe7cf96dc25f52ae43c8dfda20ee354c329f2)

I've built Mesa with the following configuration:

./autogen.sh --enable-gles2 --disable-glx --with-dri-drivers= --enable-gallium-egl --with-egl-platforms=drm --with-gallium-drivers=i915

When running the 'es2gears' example, a segmentation fault occurs.

Backtrace:

----------
Starting program: /home/christian/projects/mesa/demos/src/egl/opengles2/./es2gears 
warning: Could not load shared library symbols for linux-gate.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0xb71f1505 in pipe_loader_create_screen (dev=0xb71f1378 <gallium_screen_create+8>, library_paths=0xb72fb3c0 "/usr/local/lib/gallium-pipe") at pipe_loader.c:68
68	   return dev->ops->create_screen(dev, library_paths);
(gdb) bt
#0  0xb71f1505 in pipe_loader_create_screen (dev=0xb71f1378 <gallium_screen_create+8>, library_paths=0xb72fb3c0 "/usr/local/lib/gallium-pipe") at pipe_loader.c:68
#1  0xb71f13ab in gallium_screen_create (gdrm=gdrm@entry=0x8053fc0) at gbm.c:60
#2  0xb71f1d15 in gbm_gallium_drm_device_create (fd=7) at gbm_drm.c:248
#3  0xb7d6e643 in _gbm_create_device (fd=fd@entry=7) at main/backend.c:117
#4  0xb7d6e07f in gbm_create_device (fd=fd@entry=7) at main/gbm.c:155
#5  0xb77eae05 in native_create_display (dpy=0x0, use_sw=0 '\000') at drm/native_drm.c:246
#6  0xb77e755b in egl_g3d_initialize (drv=0x8053990, dpy=0x804f008) at common/egl_g3d.c:539
#7  0xb7fbed32 in _eglMatchAndInitialize (dpy=<optimized out>) at egldriver.c:605
#8  0xb7fbf0e4 in _eglMatchDriver (dpy=dpy@entry=0x804f008, test_only=test_only@entry=0) at egldriver.c:636
#9  0xb7fb9dc8 in eglInitialize (dpy=0x804f008, major=0x804e42c <_eglut_state+44>, minor=0x804e430 <_eglut_state+48>) at eglapi.c:318
#10 0x0804bdfa in eglutInit (argc=1, argv=0xbffff754) at ../eglut/eglut.c:219
#11 0x0804b324 in main (argc=1, argv=0xbffff754) at es2gears.c:707
(gdb) 
----------

The error seems to be caused by the use of an uninitialized pointer in 'gallium_screen_create()':

----------
int
gallium_screen_create(struct gbm_gallium_drm_device *gdrm)
{
   struct pipe_loader_device *dev;
#ifdef HAVE_PIPE_LOADER_DRM
   int ret;

   ret = pipe_loader_drm_probe_fd(&dev, gdrm->base.base.fd, true);
   if (!ret)
      return -1;
#endif /* HAVE_PIPE_LOADER_DRM */

   gdrm->screen = pipe_loader_create_screen(dev, get_library_search_path());
----------

With my configuration, HAVE_PIPE_LOADER_DRM is not defined, so the 'dev' pointer does not get initialized.
Comment 1 Emil Velikov 2014-02-22 16:54:23 UTC
Created attachment 94573 [details] [review]
targets/gbm: exit gracefully if pipe_loader_drm_probe_fd is not available
Comment 2 Emil Velikov 2014-02-24 14:59:02 UTC
Pushed to master

commit 0e7c30233f10d834ee26b7d6d32b397625e11e10
Author: Emil Velikov <emil.l.velikov@gmail.com>
Date:   Sat Feb 22 16:20:04 2014 +0000

    targets/gbm: exit gracefully if pipe_loader_drm_probe_fd is not available

    When one builds without gallium_drm_loader, the above function will
    not be available, thus we'll segfault in gallium_screen_create due
    to memory access violation.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.