nouveau: fix fence waiting logic in screen destroy
authorIlia Mirkin <imirkin@alum.mit.edu>
Thu, 6 Mar 2014 03:25:55 +0000 (22:25 -0500)
committerIlia Mirkin <imirkin@alum.mit.edu>
Sun, 9 Mar 2014 06:31:59 +0000 (01:31 -0500)
commit507f0230d4ca2238c818006499e21abb4c133203
tree275952fc89d630d424006ff46d2ca70d8c0d1f7a
parent5bf90cb521d1d6f26684b1ce9d0811c636b6abb1
nouveau: fix fence waiting logic in screen destroy

nouveau_fence_wait has the expectation that an external entity is
holding onto the fence being waited on, not that it is merely held onto
by the current pointer. Fixes a use-after-free in nouveau_fence_wait
when used on the screen's current fence.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75279
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Christoph Bumiller <e0425955@student.tuwien.ac.at>
Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
src/gallium/drivers/nouveau/nv30/nv30_screen.c
src/gallium/drivers/nouveau/nv50/nv50_screen.c
src/gallium/drivers/nouveau/nvc0/nvc0_screen.c