gallium/util: Fix incorrect refcounting of separate stencil.

The driver may have a reference on the separate stencil buffer for some
reason (like an unflushed job using it), so we can't directly free the
resource and should instead just decrement the refcount that we own.
Fixes double-free in KHR-GLES3.packed_depth_stencil.blit.depth32f_stencil8
on vc5.

Fixes: e94eb5e6000e ("gallium/util: add u_transfer_helper")
Reviewed-by: Rob Clark <robdclark@gmail.com>

diff --git a/src/gallium/auxiliary/util/u_transfer_helper.c b/src/gallium/auxiliary/util/u_transfer_helper.c
index dd31049920fccc155baea29a7f536d62defca239..3b085fd99f09d726ab3978bef3bfdc517ae2868d 100644 (file)
--- a/src/gallium/auxiliary/util/u_transfer_helper.c
+++ b/src/gallium/auxiliary/util/u_transfer_helper.c
@@ -138,8 +138,7 @@ u_transfer_helper_resource_destroy(struct pipe_screen *pscreen,
    if (helper->vtbl->get_stencil) {
       struct pipe_resource *stencil = helper->vtbl->get_stencil(prsc);
 
-      if (stencil)
-         helper->vtbl->resource_destroy(pscreen, stencil);
+      pipe_resource_reference(&stencil, NULL);
    }
 
    helper->vtbl->resource_destroy(pscreen, prsc);