loader: fix close on uninitialized file descriptor value
authorLionel Landwerlin <lionel.g.landwerlin@intel.com>
Wed, 18 Dec 2019 15:48:26 +0000 (17:48 +0200)
committerLionel Landwerlin <lionel.g.landwerlin@intel.com>
Wed, 18 Dec 2019 22:51:36 +0000 (00:51 +0200)
Using a drm syscall layer faking a kernel driver :

  ==581460== Conditional jump or move depends on uninitialised value(s)
  ==581460==    by 0x48A4C2B: close (drm-hooks.cpp:185)
  ==581460==    by 0x5A815F1: dri3_alloc_render_buffer (loader_dri3_helper.c:1469)
  ==581460==    by 0x5A82050: dri3_get_buffer (loader_dri3_helper.c:1827)
  ==581460==    by 0x5A82662: loader_dri3_get_buffers (loader_dri3_helper.c:2028)
  ==581460==    by 0x6C78109: intel_update_image_buffers (brw_context.c:1870)
  ==581460==    by 0x6C77805: intel_update_renderbuffers (brw_context.c:1499)
  ==581460==    by 0x6C7789D: intel_prepare_render (brw_context.c:1520)
  ==581460==    by 0x6C773D4: intelMakeCurrent (brw_context.c:1341)

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: 069fdd5f9fac ("egl/x11: Support DRI3 v1.1")
Reviewed-by: Eric Anholt <eric@anholt.net>
Tested-by: Marge Bot <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3152>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3152>

src/loader/loader_dri3_helper.c

index 45e1c102ed152692e5b78c85584164dd88d25242..2e1603c3fe22afa114bf13ee5bef7213e407a756 100644 (file)
@@ -1394,6 +1394,8 @@ dri3_alloc_render_buffer(struct loader_dri3_drawable *draw, unsigned int format,
          image = pixmap_buffer;
       }
 
+      buffer_fds[i] = -1;
+
       ret = draw->ext->image->queryImage(image, __DRI_IMAGE_ATTRIB_FD,
                                          &buffer_fds[i]);
       ret &= draw->ext->image->queryImage(image, __DRI_IMAGE_ATTRIB_STRIDE,
@@ -1466,7 +1468,8 @@ dri3_alloc_render_buffer(struct loader_dri3_drawable *draw, unsigned int format,
 
 no_buffer_attrib:
    do {
-      close(buffer_fds[i]);
+      if (buffer_fds[i] != -1)
+         close(buffer_fds[i]);
    } while (--i >= 0);
    draw->ext->image->destroyImage(pixmap_buffer);
 no_linear_buffer: