summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChris Wilson <chris@chris-wilson.co.uk>2012-09-14 16:12:00 +0100
committerChris Wilson <chris@chris-wilson.co.uk>2012-09-14 16:12:00 +0100
commit5369408d596a0611d4f76333dac2e1c93e63e8b6 (patch)
tree39cfba4b3a22934a10b2d7008884ebe63e676b35
parent8e9d64203428b344433ac8f86dc1f06d2c32529a (diff)
sna/dri: And the hunt for the use-after-free continues...
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r--src/sna/sna_dri.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c
index 2296ab65..d6cc2aa4 100644
--- a/src/sna/sna_dri.c
+++ b/src/sna/sna_dri.c
@@ -196,11 +196,13 @@ static struct kgem_bo *sna_pixmap_set_dri(struct sna *sna,
constant static inline void *sna_pixmap_get_buffer(PixmapPtr pixmap)
{
+ assert(pixmap->refcnt);
return ((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2];
}
static inline void sna_pixmap_set_buffer(PixmapPtr pixmap, void *ptr)
{
+ assert(pixmap->refcnt);
((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2] = ptr;
}
@@ -429,8 +431,11 @@ static void set_bo(PixmapPtr pixmap, struct kgem_bo *bo)
sna_damage_destroy(&priv->cpu_damage);
priv->undamaged = false;
- kgem_bo_destroy(&sna->kgem, priv->gpu_bo);
- priv->gpu_bo = ref(bo);
+ assert(bo->refcnt);
+ if (priv->gpu_bo != bo) {
+ kgem_bo_destroy(&sna->kgem, priv->gpu_bo);
+ priv->gpu_bo = ref(bo);
+ }
if (bo->domain != DOMAIN_GPU)
bo->domain = DOMAIN_NONE;