github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-06-29 16:58:10 +00:00
Code Issues Projects Releases Wiki Activity

ACRN:DM:VDISPLAY:Fix the possible access after free

Browse Source 
When virtio-gpu tries to submit the framebuffer based on
VIRTIO_GPU_CMD_2D, one pixman_image will be created. When the
sdl rendering_thread is terminated, the pixman_image will be 
released. But its pointer is set to NULL. In the next reboot,
its access in vdpy_surface_set is incorrect.  

Tracked-On: #7337
Acked-by: Wang Yu <yu1.wang@intel.com>
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
This commit is contained in:
Zhao Yakui 2022-04-21 15:46:51 +08:00 committed by acrnsi-robot
parent 2d968105f1
commit 2a7a269313
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
devicemodel/hw/vdisplay_sdl.c
View File

@ -941,6 +941,7 @@ vdpy_sdl_display_thread(void *data)
} }
vdpy.dpy_win = NULL; vdpy.dpy_win = NULL;
vdpy.dpy_renderer = NULL; vdpy.dpy_renderer = NULL;
vdpy.dpy_img = NULL;
vdpy.dpy_win = SDL_CreateWindow("ACRN_DM", vdpy.dpy_win = SDL_CreateWindow("ACRN_DM",
vdpy.org_x, vdpy.org_y, vdpy.org_x, vdpy.org_y,
vdpy.width, vdpy.height, vdpy.width, vdpy.height,
@ -1010,8 +1011,10 @@ vdpy_sdl_display_thread(void *data)
/* SDL display_thread will exit because of DM request */ /* SDL display_thread will exit because of DM request */
pthread_mutex_destroy(&vdpy.vdisplay_mutex); pthread_mutex_destroy(&vdpy.vdisplay_mutex);
pthread_cond_destroy(&vdpy.vdisplay_signal); pthread_cond_destroy(&vdpy.vdisplay_signal);
if (vdpy.dpy_img) if (vdpy.dpy_img) {
pixman_image_unref(vdpy.dpy_img); pixman_image_unref(vdpy.dpy_img);
vdpy.dpy_img = NULL;
}
/* Continue to thread cleanup */ /* Continue to thread cleanup */
if (vdpy.dpy_texture) { if (vdpy.dpy_texture) {