sna: Nullify pixmap->devPrivate.ptr after promoting CPU bo to GPU

When we convert a CPU bo into a GPU bo, we need to remove any dangling
shadow pointers we use for devPrivate.ptr. Whilst the bo remains alive
these are incoherent, but if we ever replace the GPU bo (for example to
change tiling for DRI2) then the dangling pointer becomes invalid and
will explode on next use.

Reported-by: Mike Aury <mike.auty@gmail.com>
Reported-by:  Marti Raudsepp <marti@juffo.org>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73351
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 5d25bf7..40ae4c0 100644 (file)
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -3834,9 +3834,11 @@ sna_pixmap_move_to_gpu(PixmapPtr pixmap, unsigned flags)
                            priv->cpu_bo && !priv->shm &&
                            kgem_bo_convert_to_gpu(&sna->kgem, priv->cpu_bo)) {
                                assert(!priv->mapped);
+                               assert(!IS_STATIC_PTR(priv->ptr));
                                priv->gpu_bo = priv->cpu_bo;
                                priv->cpu_bo = NULL;
                                priv->ptr = NULL;
+                               pixmap->devPrivate.ptr = NULL;
                                sna_damage_all(&priv->gpu_damage,
                                               pixmap->drawable.width,
                                               pixmap->drawable.height);