fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 18:18:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

rusticl/memory: fix potential use-after-free in clEnqueueSVMMemFill

Browse source 
Fixes: bfee3a8563 ("rusticl: add support for fine-grained system SVM")
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reported-by: @LingMan <18294-LingMan@users.noreply.gitlab.freedesktop.org>
Reviewed-by: @LingMan <18294-LingMan@users.noreply.gitlab.freedesktop.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25637>
This commit is contained in:
Karol Herbst 2023-10-10 13:23:52 +02:00 • committed by Marge Bot
parent a157ab7b33
commit 119c213087
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/gallium/frontends/rusticl/api/memory.rs
View file

@ -2591,6 +2591,9 @@ fn enqueue_svm_mem_fill_impl(
return Err(CL_INVALID_VALUE);
}
// The application is allowed to reuse or free the memory referenced by `pattern` after this
// function returns so we have to make a copy.
let pattern: Vec<u8> = unsafe { slice::from_raw_parts(pattern.cast(), pattern_size).to_vec() };
create_and_queue(
q,
cmd_type,
@ -2602,7 +2605,7 @@ fn enqueue_svm_mem_fill_impl(
while offset < size {
// SAFETY: pointer are either valid or undefined behavior
unsafe {
ptr::copy(pattern, svm_ptr.add(offset), pattern_size);
ptr::copy(pattern.as_ptr().cast(), svm_ptr.add(offset), pattern_size);
}
offset += pattern_size;
}