virgl: virgl_transfer should own its virgl_resource

We should avoid having potentially dangling pointers to
pipe_resources in general.

Signed-off-by: Chia-I Wu <[email protected]>
Reviewed-by: Alexandros Frantzis <[email protected]>

2 files changed, 6 insertions, 8 deletions

diff --git a/src/gallium/drivers/virgl/virgl_resource.c b/src/gallium/drivers/virgl/virgl_resource.c
index e840caa52a9..4d427894dac 100644
--- a/src/gallium/drivers/virgl/virgl_resource.c
+++ b/src/gallium/drivers/virgl/virgl_resource.c
@@ -415,7 +415,9 @@ virgl_resource_create_transfer(struct virgl_context *vctx,
    if (!trans)
       return NULL;
 
-   trans->base.resource = pres;
+   /* note that trans is not zero-initialized */
+   trans->base.resource = NULL;
+   pipe_resource_reference(&trans->base.resource, pres);
    trans->base.level = level;
    trans->base.usage = usage;
    trans->base.box = *box;
@@ -442,7 +444,9 @@ void virgl_resource_destroy_transfer(struct virgl_context *vctx,
                                      struct virgl_transfer *trans)
 {
    pipe_resource_reference(&trans->copy_src_res, NULL);
+
    util_range_destroy(&trans->range);
+   pipe_resource_reference(&trans->base.resource, NULL);
    slab_free(&vctx->transfer_pool, trans);
 }
 
diff --git a/src/gallium/drivers/virgl/virgl_transfer_queue.c b/src/gallium/drivers/virgl/virgl_transfer_queue.c
index 81edfe51ffb..f41c0defbbe 100644
--- a/src/gallium/drivers/virgl/virgl_transfer_queue.c
+++ b/src/gallium/drivers/virgl/virgl_transfer_queue.c
@@ -120,9 +120,7 @@ static void remove_transfer(struct virgl_transfer_queue *queue,
                             struct list_action_args *args)
 {
    struct virgl_transfer *queued = args->queued;
-   struct pipe_resource *pres = queued->base.resource;
    list_del(&queued->queue_link);
-   pipe_resource_reference(&pres, NULL);
    virgl_resource_destroy_transfer(queue->vctx, queued);
 }
 
@@ -292,13 +290,9 @@ void virgl_transfer_queue_fini(struct virgl_transfer_queue *queue)
 int virgl_transfer_queue_unmap(struct virgl_transfer_queue *queue,
                                struct virgl_transfer *transfer)
 {
-   struct pipe_resource *res, *pres;
+   struct pipe_resource *res = transfer->base.resource;
    struct list_iteration_args iter;
 
-   pres = NULL;
-   res = transfer->base.resource;
-   pipe_resource_reference(&pres, res);
-
    /* We don't support copy transfers in the transfer queue. */
    assert(!transfer->copy_src_res);