| What | Removed | Added |
|---|---|---|
| Status | NEW | RESOLVED |
| Resolution | --- | INVALID |
Comment # 12
on bug 65968
from Andreas Ringlstetter
It's a bug in PA itself, not in Mesa. The root cause is a race condition on the shared buffer which is used to transfer the rendered HTML UI from the Coherent host process back to PA. There is a missing mutex inside PA when the buffer gets reallocated as a result of a window resize event. Effectively, this results in a use-after-free by the render thread of the PA process. The faster the realloc, the lower the chance of this bug occurring. It's also subject to possibly missing protections against use after free conditions on previously shared buffers. And also to the memory allocation strategy, as a reuse of the same memory region without a clear leads to the most visible effect. Unfortunately, various Mesa drivers so not wipe the video memory after a buffer was returned to the global pool!
You are receiving this mail because:
- You are the assignee for the bug.
_______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
