fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-04-21 12:00:41 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

anv: Protect against OOB access to anv_state_pool::buckets

Browse source 
Suggested-by: Paulo Zanoni
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: mesa-stable
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/30751>
This commit is contained in:
Ian Romanick 2024-08-20 16:43:59 -07:00 • committed by Marge Bot
parent 2fa52bf6e5
commit 0921dfa044
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/intel/vulkan/anv_allocator.c
View file

@ -777,6 +777,10 @@ anv_state_pool_return_blocks(struct anv_state_pool *pool,
}
uint32_t block_bucket = anv_state_pool_get_bucket(block_size);
if (block_bucket >= ARRAY_SIZE(pool->buckets))
return;
anv_free_list_push(&pool->buckets[block_bucket].free_list,
&pool->table, st_idx, count);
}
@ -839,6 +843,9 @@ anv_state_pool_alloc_no_vg(struct anv_state_pool *pool,
{
uint32_t bucket = anv_state_pool_get_bucket(MAX2(size, align));
if (bucket >= ARRAY_SIZE(pool->buckets))
return ANV_STATE_NULL;
struct anv_state *state;
uint32_t alloc_size = anv_state_pool_get_bucket_size(bucket);
int64_t offset;
@ -949,6 +956,9 @@ anv_state_pool_free_no_vg(struct anv_state_pool *pool, struct anv_state state)
assert(state.offset >= pool->start_offset);
if (bucket >= ARRAY_SIZE(pool->buckets))
return;
anv_free_list_push(&pool->buckets[bucket].free_list,
&pool->table, state.idx, 1);
}