zink: fix heap-use-after-free on batch_state with sub-allocated pipe_resources
authorKarol Herbst <kherbst@redhat.com>
Thu, 4 Jan 2024 01:42:16 +0000 (02:42 +0100)
committerEric Engestrom <eric@engestrom.ch>
Tue, 9 Jan 2024 17:31:42 +0000 (17:31 +0000)
commitcff9bdc316ea01b08fbeb0a006b06c287e457b91
treefb35c7df9a7c8544480003b456386223c91fb760
parent5d1329a1b348f0f63b926792d7c0c1cae2a4e007
zink: fix heap-use-after-free on batch_state with sub-allocated pipe_resources

zink_bo_create can run into a heap-use-after-free when the bo is still
referencing an batch_state from an older destroyed context. In order to
fix this, every context gives back their batch_states to the zink, where
they can be reused from for new contexts.

Cc: mesa-stable
Suggested-by: Mike Blumenkrantz <michael.blumenkrantz@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/26889>
(cherry picked from commit b06f6e00fba6e33c28a198a1bb14b89e9dfbb4ae)
.pick_status.json
src/gallium/drivers/zink/zink_batch.c
src/gallium/drivers/zink/zink_context.c
src/gallium/drivers/zink/zink_screen.c
src/gallium/drivers/zink/zink_types.h