radeon/vcn: set dec->bs_ptr = NULL on unmap
To avoid using a dangling pointer.
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/1308
Cc: mesa-stable
Reviewed-by: Boyuan Zhang <boyuan.zhang@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6556>
diff --git a/src/gallium/drivers/radeon/radeon_vcn_dec.c b/src/gallium/drivers/radeon/radeon_vcn_dec.c
index 849270a..f0ecf1c 100644
--- a/src/gallium/drivers/radeon/radeon_vcn_dec.c
+++ b/src/gallium/drivers/radeon/radeon_vcn_dec.c
@@ -964,6 +964,7 @@
PIPE_TRANSFER_WRITE | RADEON_TRANSFER_TEMPORARY);
fill_probs_table(ptr);
dec->ws->buffer_unmap(dec->ctx.res->buf);
+ dec->bs_ptr = NULL;
}
break;
}
@@ -1077,6 +1078,7 @@
/* unmap the buffer */
dec->ws->buffer_unmap(buf->res->buf);
+ dec->bs_ptr = NULL;
dec->msg = NULL;
dec->fb = NULL;
dec->it = NULL;
@@ -1367,6 +1369,7 @@
if (new_size > buf->res->buf->size) {
dec->ws->buffer_unmap(buf->res->buf);
+ dec->bs_ptr = NULL;
if (!si_vid_resize_buffer(dec->screen, dec->cs, buf, new_size)) {
RVID_ERR("Can't resize bitstream buffer!");
return;
@@ -1400,6 +1403,7 @@
memset(dec->bs_ptr, 0, align(dec->bs_size, 128) - dec->bs_size);
dec->ws->buffer_unmap(bs_buf->res->buf);
+ dec->bs_ptr = NULL;
map_msg_fb_it_probs_buf(dec);
dt = rvcn_dec_message_decode(dec, target, picture);
@@ -1559,6 +1563,7 @@
ptr += FB_BUFFER_OFFSET + FB_BUFFER_SIZE;
fill_probs_table(ptr);
dec->ws->buffer_unmap(buf->res->buf);
+ dec->bs_ptr = NULL;
}
}
diff --git a/src/gallium/drivers/radeon/radeon_vcn_dec_jpeg.c b/src/gallium/drivers/radeon/radeon_vcn_dec_jpeg.c
index edf03d7..6d85467 100644
--- a/src/gallium/drivers/radeon/radeon_vcn_dec_jpeg.c
+++ b/src/gallium/drivers/radeon/radeon_vcn_dec_jpeg.c
@@ -288,6 +288,7 @@
memset(dec->bs_ptr, 0, align(dec->bs_size, 128) - dec->bs_size);
dec->ws->buffer_unmap(bs_buf->res->buf);
+ dec->bs_ptr = NULL;
dt = radeon_jpeg_get_decode_param(dec, target, picture);
