Skip to content
Commit adf134b6 authored by Pascal Nowack's avatar Pascal Nowack
Browse files

rdp-gfx-surface: Delete GFX surface before clearing its members

When clearing a GFX surface, the graphics pipeline currently first
clears its members, which are, if they exist, the render surface and
the frame controller, and then deletes the GFX surface itself.
This has currently the effect, that when the client sends a frame
acknowledgement for a frame, that was rendered on a GFX surface, that
is about to be cleared, that the respective frame controller is used,
while it is in the process of being deleted leading to a crash, where a
NULL pointer is dereferenced.
The reason for this situation is that for each surface, a surface
context is created, which also contains a pointer to the GFX surface.
This is necessary to be able to map frame ids to surfaces at any time,
even when the respective surface is already deleted.
When clearing a surface, it is first removed from the surface table,
while the GFX mutex is locked, and then actually deleted, where the GFX
mutex has to be unlocked first, to not lock it again.
In this process of unlocking the GFX mutex and locking it again a frame
acknowledgement can happen, and in this situation, the frame controller
might be in the process of deletion, leading to a NULL pointer
dereference, where the frame controller or one of its members is being
looked up.

To fix this issue, simply delete the GFX surface first. This also
clears the pointer to the GFX surface in the surface context.
The other members of the GFX surface can afterwards be cleared without
any problems.

https://errors.ubuntu.com/problem/ecf34bd0b58c72cf2d1f03ba4222b71cc62e0d83
parent b4e2607f
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment