Commit 0dd3dee3 authored by marmeladema's avatar marmeladema

lima: fix NULL pointer dereference on error path in lima_context_destroy

When the following code path happens:
lima_context_create
|-> lima_submit_create
    |-> drmSyncobjCreate: can fail here
    |Thus ctx->pp_submit and ctx->gp_submit are NULL
    |-> lima_context_destroy
        |-> lima_submit_free: will access submit->in_sync_fd

It triggers a segfault in mesa because we are trying to derefence
both ctx->pp_submit and ctx->gp_submit which are NULL.
parent b10faf6e
......@@ -117,8 +117,10 @@ lima_context_destroy(struct pipe_context *pctx)
struct lima_context *ctx = lima_context(pctx);
struct lima_screen *screen = lima_screen(pctx->screen);
lima_submit_free(ctx->pp_submit);
lima_submit_free(ctx->gp_submit);
if (ctx->pp_submit)
lima_submit_free(ctx->pp_submit);
if (ctx->gp_submit)
lima_submit_free(ctx->gp_submit);
for (int i = 0; i < lima_ctx_buff_num; i++)
pipe_resource_reference(&ctx->buffer_state[i].res, NULL);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment