Bug 108713 - Gallium: use after free with transform feedback
Summary: Gallium: use after free with transform feedback
Alias: None
Product: Mesa
Classification: Unclassified
Component: Other (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: mesa-dev
QA Contact: mesa-dev
Depends on:
Reported: 2018-11-12 10:01 UTC by Gert Wollny
Modified: 2018-11-28 18:19 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Description Gert Wollny 2018-11-12 10:01:38 UTC
With the call sequence 

glBindTransformFeedback(..., 1)
/*do something*/

glBindTransformFeedback(..., 0)
glBindTransformFeedback(..., 1)

there is a use after free in glEndTransformFeedback(): 

#0 0x7f93bfecfda1 in st_end_transform_feedback mesa/state_tracker/st_cb_xformfb.c:206
    #1 0x7f93bf84fecc in end_transform_feedback mesa/main/transformfeedback.c:505
    #2 0x7f93bf8500d7 in _mesa_EndTransformFeedback mesa/main/transformfeedback.c:535

because the transform feedback holds a stale link to the shader program.  

I've seen this error on r600 and it was also confirmed on radeonsi, the same code runs fine with i965. 

That spec says

"If a program object is in use as part of current rendering state, it will be flagged for deletion, but it will not be deleted until it is no longer part of current state for any rendering context."

So since the shader program is part of the current rendering state it should still be available. 

I am however not completely sure about this, because the transform feedback object was not bound when the program was deleted, so maybe the deleted program should not be part of its state. 

So either the shader gets deleted too early, or the transform feedback object is not properly notified about the shader being deleted.
Comment 1 Gert Wollny 2018-11-12 10:46:09 UTC
I'll send a patch shortly.
Comment 2 Juan A. Suarez 2018-11-28 18:19:16 UTC
This was fixed in upstream and 18.2.6.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.