From patchwork Thu Sep 23 12:50:56 2010
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Kristian Hogsberg <krh@bitplanet.net>
X-Patchwork-Id: 201912
Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177])
	by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id o8NCqIxB005535
	for <patchwork-intel-gfx@patchwork.kernel.org>;
	Thu, 23 Sep 2010 12:52:54 GMT
Received: from gabe.freedesktop.org (localhost [127.0.0.1])
	by gabe.freedesktop.org (Postfix) with ESMTP id A31729EFF5
	for <patchwork-intel-gfx@patchwork.kernel.org>;
	Thu, 23 Sep 2010 05:52:18 -0700 (PDT)
X-Original-To: intel-gfx@lists.freedesktop.org
Delivered-To: intel-gfx@lists.freedesktop.org
Received: from mga03.intel.com (mga03.intel.com [143.182.124.21])
	by gabe.freedesktop.org (Postfix) with ESMTP id E47D19E97E;
	Thu, 23 Sep 2010 05:51:55 -0700 (PDT)
Received: from azsmga001.ch.intel.com ([10.2.17.19])
	by azsmga101.ch.intel.com with ESMTP; 23 Sep 2010 05:51:55 -0700
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="4.57,223,1283756400"; d="scan'208";a="327871632"
Received: from unknown (HELO intel.com) ([10.255.14.49])
	by azsmga001.ch.intel.com with ESMTP; 23 Sep 2010 05:51:54 -0700
From: =?UTF-8?q?Kristian=20H=C3=B8gsberg?= <krh@bitplanet.net>
To: Chris Wilson <chris@chris-wilson.co.uk>,
	Julien Cristau <jcristau@debian.org>, xorg-devel@lists.freedesktop.org
Date: Thu, 23 Sep 2010 08:50:56 -0400
Message-Id: <1285246256-2306-1-git-send-email-krh@bitplanet.net>
X-Mailer: git-send-email 1.7.3
In-Reply-To: <8u3s8d$jlbce9@orsmga001.jf.intel.com>
References: <8u3s8d$jlbce9@orsmga001.jf.intel.com>
MIME-Version: 1.0
Cc: intel-gfx@lists.freedesktop.org
Subject: [Intel-gfx] [PATCH] glx: Fix use after free in DrawableGone
X-BeenThere: intel-gfx@lists.freedesktop.org
X-Mailman-Version: 2.1.11
Precedence: list
List-Id: Intel graphics driver community testing & development
	<intel-gfx.lists.freedesktop.org>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Sender: 
 intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org
Errors-To: 
 intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org
X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by
	milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]);
	Thu, 23 Sep 2010 12:52:54 +0000 (UTC)
X-MIME-Autoconverted: from base64 to 8bit by demeter1.kernel.org id
	o8NCqIxB005535


diff --git a/glx/glxext.c b/glx/glxext.c
index e203156..0b04c37 100644
--- a/glx/glxext.c
+++ b/glx/glxext.c
@@ -160,15 +160,13 @@ static Bool DrawableGone(__GLXdrawable *glxPriv, XID xid)
 		    }
 		}
 	    }
-
-	    if (!c->idExists) {
-		__glXFreeContext(c);
-	    }
 	}
 	if (c->drawPriv == glxPriv)
 	    c->drawPriv = NULL;
 	if (c->readPriv == glxPriv)
 	    c->readPriv = NULL;
+	if (!c->idExists && !c->isCurrent)
+	    __glXFreeContext(c);
     }
 
     glxPriv->destroy(glxPriv);