From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date: Wed, 18 Dec 2019 15:48:26 +0000 (+0200)
Subject: loader: fix close on uninitialized file descriptor value
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=fc2552b6445a1295c18acf8798411da85bbc5387;p=mesa.git

loader: fix close on uninitialized file descriptor value

Using a drm syscall layer faking a kernel driver :

  ==581460== Conditional jump or move depends on uninitialised value(s)
  ==581460==    by 0x48A4C2B: close (drm-hooks.cpp:185)
  ==581460==    by 0x5A815F1: dri3_alloc_render_buffer (loader_dri3_helper.c:1469)
  ==581460==    by 0x5A82050: dri3_get_buffer (loader_dri3_helper.c:1827)
  ==581460==    by 0x5A82662: loader_dri3_get_buffers (loader_dri3_helper.c:2028)
  ==581460==    by 0x6C78109: intel_update_image_buffers (brw_context.c:1870)
  ==581460==    by 0x6C77805: intel_update_renderbuffers (brw_context.c:1499)
  ==581460==    by 0x6C7789D: intel_prepare_render (brw_context.c:1520)
  ==581460==    by 0x6C773D4: intelMakeCurrent (brw_context.c:1341)

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: 069fdd5f9fac ("egl/x11: Support DRI3 v1.1")
Reviewed-by: Eric Anholt <eric@anholt.net>
Tested-by: Marge Bot <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3152>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3152>
---

diff --git a/src/loader/loader_dri3_helper.c b/src/loader/loader_dri3_helper.c
index 45e1c102ed1..2e1603c3fe2 100644
--- a/src/loader/loader_dri3_helper.c
+++ b/src/loader/loader_dri3_helper.c
@@ -1394,6 +1394,8 @@ dri3_alloc_render_buffer(struct loader_dri3_drawable *draw, unsigned int format,
          image = pixmap_buffer;
       }
 
+      buffer_fds[i] = -1;
+
       ret = draw->ext->image->queryImage(image, __DRI_IMAGE_ATTRIB_FD,
                                          &buffer_fds[i]);
       ret &= draw->ext->image->queryImage(image, __DRI_IMAGE_ATTRIB_STRIDE,
@@ -1466,7 +1468,8 @@ dri3_alloc_render_buffer(struct loader_dri3_drawable *draw, unsigned int format,
 
 no_buffer_attrib:
    do {
-      close(buffer_fds[i]);
+      if (buffer_fds[i] != -1)
+         close(buffer_fds[i]);
    } while (--i >= 0);
    draw->ext->image->destroyImage(pixmap_buffer);
 no_linear_buffer: