[PATCH 1/2] shm: Fix use-after-free in ShmDestroyPixmap

[Michel Dänzer]

On 15.02.2015 06:30, Chris Wilson wrote:
> On Sat, Feb 14, 2015 at 08:33:18PM +0900, Michel Dänzer wrote:
>> On 14.02.2015 19:36, Chris Wilson wrote:
>>>   /*ARGSUSED*/ static int
>>>  ShmDetachSegment(void *value, /* must conform to DeleteType */
>>> -                 XID shmseg)
>>> +                 XID unused)
>>>  {
>>>      ShmDescPtr shmdesc = (ShmDescPtr) value;
>>>      ShmDescPtr *prev;
>>>
>>
>> It's a static function, so you can just remove the unused parameter.
> 
> We want to keep it around so that it matches DeleteType as it is passed
> to CreateNewResourceType as the cleanup handler for the resource. The
> comment is telling the truth for once!

Gotcha, sorry for the noise.

Reviewed-by: Michel Dänzer <michel at daenzer.net>


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer