From aaabb5b0f209dfad32ff108a49f39871e688444f Mon Sep 17 00:00:00 2001 From: Mike Blumenkrantz Date: Tue, 19 Sep 2023 08:53:42 -0400 Subject: [PATCH] zink: avoid UAF on wayland async present with to-be-retired swapchain wayland surfaces are likely to become unlinked in WSI implementations upon retiring a swapchain, requiring the pending present to complete in order to avoid invalid access cc: mesa-stable Part-of: --- src/gallium/drivers/zink/zink_kopper.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/gallium/drivers/zink/zink_kopper.c b/src/gallium/drivers/zink/zink_kopper.c index 0ea3c5515b3..e5386b5e4b1 100644 --- a/src/gallium/drivers/zink/zink_kopper.c +++ b/src/gallium/drivers/zink/zink_kopper.c @@ -255,6 +255,9 @@ kopper_CreateSwapchain(struct zink_screen *screen, struct kopper_displaytarget * bool has_alpha = cdt->info.has_alpha && (cdt->caps.supportedCompositeAlpha & VK_COMPOSITE_ALPHA_PRE_MULTIPLIED_BIT_KHR); if (cdt->swapchain) { cswap->scci = cdt->swapchain->scci; + /* avoid UAF if async present needs to-be-retired swapchain */ + if (cdt->type == KOPPER_WAYLAND && cdt->swapchain->swapchain) + util_queue_fence_wait(&cdt->swapchain->present_fence); cswap->scci.oldSwapchain = cdt->swapchain->swapchain; } else { cswap->scci.sType = VK_STRUCTURE_TYPE_SWAPCHAIN_CREATE_INFO_KHR;