diff options
author | Chris Wilson <chris@chris-wilson.co.uk> | 2012-09-14 16:12:00 +0100 |
---|---|---|
committer | Chris Wilson <chris@chris-wilson.co.uk> | 2012-09-14 16:12:00 +0100 |
commit | 5369408d596a0611d4f76333dac2e1c93e63e8b6 (patch) | |
tree | 39cfba4b3a22934a10b2d7008884ebe63e676b35 | |
parent | 8e9d64203428b344433ac8f86dc1f06d2c32529a (diff) |
sna/dri: And the hunt for the use-after-free continues...
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r-- | src/sna/sna_dri.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c index 2296ab65..d6cc2aa4 100644 --- a/src/sna/sna_dri.c +++ b/src/sna/sna_dri.c @@ -196,11 +196,13 @@ static struct kgem_bo *sna_pixmap_set_dri(struct sna *sna, constant static inline void *sna_pixmap_get_buffer(PixmapPtr pixmap) { + assert(pixmap->refcnt); return ((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2]; } static inline void sna_pixmap_set_buffer(PixmapPtr pixmap, void *ptr) { + assert(pixmap->refcnt); ((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2] = ptr; } @@ -429,8 +431,11 @@ static void set_bo(PixmapPtr pixmap, struct kgem_bo *bo) sna_damage_destroy(&priv->cpu_damage); priv->undamaged = false; - kgem_bo_destroy(&sna->kgem, priv->gpu_bo); - priv->gpu_bo = ref(bo); + assert(bo->refcnt); + if (priv->gpu_bo != bo) { + kgem_bo_destroy(&sna->kgem, priv->gpu_bo); + priv->gpu_bo = ref(bo); + } if (bo->domain != DOMAIN_GPU) bo->domain = DOMAIN_NONE; |