util/hash_table: Don't leak hash_key_u64 objects when the u64 hash table is destroyed
authorBoris Brezillon <boris.brezillon@collabora.com>
Wed, 29 Nov 2023 20:02:49 +0000 (21:02 +0100)
committerEric Engestrom <eric@engestrom.ch>
Sun, 17 Dec 2023 23:48:00 +0000 (23:48 +0000)
commite839b0ae2e9b1d342779e723d22e6d4aa58a0da9
tree9897ac99e2605728ebd0e68cbbbb7c32e279afb9
parente2427f915cbab0f20cd6b145bb8b38b15277245d
util/hash_table: Don't leak hash_key_u64 objects when the u64 hash table is destroyed

Allocate a ralloc sub-context which takes the u64 hash table as a parent
and attach a destructor to it so we can free the hash_key_u64 objects
that were allocated by _mesa_hash_table_u64_insert().

The order of creation of this sub-context is crucial: it needs to happen
after the _mesa_hash_table_create() call to guarantee that the
destructor is called before ht->table and its children are freed,
otherwise the _mesa_hash_table_u64_clear() call in the destructor leads
to a use-after-free situation.

Fixes: ff494361bee7 ("util: rzalloc and free hash_table_u64")
Cc: stable
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Yonggang Luo <luoyonggang@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/26423>
(cherry picked from commit db5166718d89ba71f8d12fbdceffb05d7c5e9a03)
.pick_status.json
src/util/hash_table.c