[Dri-devel] use of freed memory in radeon driver

[Michel <mi...@da...>]

My first glean runs resulted in segfaults. Running electric fence in
gdb, I got this backtrace:

#0  mmAllocMem (heap=3D0x3598cfe8, size=3D262144, align2=3D0, startSearch=
=3D0)
    at mm.c:125
#1  0x0f816614 in radeonTexturesGone (rmesa=3D0x3552cdf8, heap=3D0, offset=
=3D0,=20
    size=3D262144, in_use=3D1) at radeon_texmem.c:262
#2  0x0f8167a0 in radeonAgeTextures (rmesa=3D0x3552cdf8, heap=3D0)
    at radeon_texmem.c:301
#3  0x0f7ea870 in radeonGetLock (rmesa=3D0x3552cdf8, flags=3D262144)
    at radeon_lock.c:121
#4  0x0f7e87c8 in radeonFlushCmdBuf (rmesa=3D0x3552cdf8,=20
    caller=3D0xf846e90 "radeonFlush") at radeon_ioctl.c:441
#5  0x0f7ea2f8 in radeonFlush (ctx=3D0x3598cfe8) at radeon_ioctl.c:1125
#6  0x0f7e6e98 in radeonDestroyContext (driContextPriv=3D0x3552d5b4)
    at radeon_context.c:568
#7  0x0f68dcf4 in driDestroyContext ()
   from /usr/local/X11R6-DRI/lib/modules/dri/radeon_dri.so
#8  0x0fe7c738 in __glXFreeContext () from /usr/lib/libGL.so.1
#9  0x0fe7c850 in glXDestroyContext () from /usr/lib/libGL.so.1
#10 0x1000b874 in GLEAN::RenderingContext::~RenderingContext (this=3D0x7fff=
f878,=20
    __in_chrg=3D805558984) at rc.cpp:152
#11 0x10056238 in GLEAN::BaseTest<GLEAN::OPResult>::run (this=3D0x0,=20
    environment=3D@0x40000) at tbase.h:273
#12 0x10009f84 in main (argc=3D3, argv=3D0x7ffffa04) at main.cpp:121
#13 0x0fa50c50 in __libc_start_main () from /lib/libc.so.6


It's trying to allocate memory from a heap that's already been destroyed
(and thus the memory freed). How does the attached patch (which avoids
the problem) look?


--=20
Earthling Michel D=E4nzer (MrCooper)/ Debian GNU/Linux (powerpc) developer
XFree86 and DRI project member   /  CS student, Free Software enthusiast