KonstantinSeurer
/
mesa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mesa/st: Fix a use-after-free of the NIR shader stage. 

We just freed the NIR after turning it into TGSI, no using it in that last
switch statement.

Closes: #3725
Fixes: 57effa342b ("st/mesa: Drop the TGSI paths for PBOs and use nir-to-tgsi if needed.")
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/7407>
This commit is contained in:
Eric Anholt 2020-11-02 10:11:11 -08:00 committed by Marge Bot
parent 6b85a887ff
commit 71a197943c
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/mesa/state_tracker/st_nir_builtins.c
View File

@ -34,11 +34,12 @@ st_nir_finish_builtin_shader(struct st_context *st,
{
struct pipe_context *pipe = st->pipe;
struct pipe_screen *screen = pipe->screen;
enum pipe_shader_type sh = pipe_shader_type_from_mesa(nir->info.stage);
gl_shader_stage stage = nir->info.stage;
enum pipe_shader_type sh = pipe_shader_type_from_mesa(stage);
nir->info.name = ralloc_strdup(nir, name);
nir->info.separate_shader = true;
if (nir->info.stage == MESA_SHADER_FRAGMENT)
if (stage == MESA_SHADER_FRAGMENT)
nir->info.fs.untyped_color_outputs = true;
NIR_PASS_V(nir, nir_lower_global_vars_to_local);
@ -49,8 +50,8 @@ st_nir_finish_builtin_shader(struct st_context *st,
if (nir->options->lower_to_scalar) {
nir_variable_mode mask =
(nir->info.stage > MESA_SHADER_VERTEX ? nir_var_shader_in : 0) |
(nir->info.stage < MESA_SHADER_FRAGMENT ? nir_var_shader_out : 0);
(stage > MESA_SHADER_VERTEX ? nir_var_shader_in : 0) |
(stage < MESA_SHADER_FRAGMENT ? nir_var_shader_out : 0);
NIR_PASS_V(nir, nir_lower_io_to_scalar_early, mask);
}
@ -82,7 +83,7 @@ st_nir_finish_builtin_shader(struct st_context *st,
ralloc_free(nir);
}
switch (nir->info.stage) {
switch (stage) {
case MESA_SHADER_VERTEX:
return pipe->create_vs_state(pipe, &state);
case MESA_SHADER_TESS_CTRL: