From 192ced78f07c79032ec69b8ef2f70769f71543c2 Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Wed, 25 Apr 2018 09:47:40 -0700 Subject: gallium/util: Fix incorrect refcounting of separate stencil. The driver may have a reference on the separate stencil buffer for some reason (like an unflushed job using it), so we can't directly free the resource and should instead just decrement the refcount that we own. Fixes double-free in KHR-GLES3.packed_depth_stencil.blit.depth32f_stencil8 on vc5. Fixes: e94eb5e6000e ("gallium/util: add u_transfer_helper") Reviewed-by: Rob Clark (cherry picked from commit 069c409f434ab215940aad2092d5d236b410a7b9) --- src/gallium/auxiliary/util/u_transfer_helper.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/gallium/auxiliary/util/u_transfer_helper.c b/src/gallium/auxiliary/util/u_transfer_helper.c index dd31049920..3b085fd99f 100644 --- a/src/gallium/auxiliary/util/u_transfer_helper.c +++ b/src/gallium/auxiliary/util/u_transfer_helper.c @@ -138,8 +138,7 @@ u_transfer_helper_resource_destroy(struct pipe_screen *pscreen, if (helper->vtbl->get_stencil) { struct pipe_resource *stencil = helper->vtbl->get_stencil(prsc); - if (stencil) - helper->vtbl->resource_destroy(pscreen, stencil); + pipe_resource_reference(&stencil, NULL); } helper->vtbl->resource_destroy(pscreen, prsc); -- cgit v1.2.3