fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 02:48:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

nv50,nvc0: Avoid uninitialized cbuf reads in blits

Browse source 
Overwrite the whole framebuffer cbuf rather than copying it from the
stack; fixes util_framebuffer_get_num_samples getting uninitialized
stack contents during validation.

Suggested-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Fixes: 2eb45daa9c ("gallium: de-pointerize pipe_surface")
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14082
(cherry picked from commit a6992c7bbe)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40752>
This commit is contained in:
Alyssa Milburn 2026-01-03 22:06:10 +01:00 • committed by Eric Engestrom
parent b26748a918
commit 7b5e16fb05
3 changed files with 25 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -2394,7 +2394,7 @@
"description": "nv50,nvc0: Avoid uninitialized cbuf reads in blits",
"nominated": true,
"nomination_type": 2,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "2eb45daa9c86f4b8bd602ddef7a67233f56f1edf",
"notes": null

24
src/gallium/drivers/nouveau/nv50/nv50_surface.c
View file

@ -1094,26 +1094,26 @@ nv50_blit_set_dst(struct nv50_blitctx *ctx,
{
struct nv50_context *nv50 = ctx->nv50;
struct pipe_context *pipe = &nv50->base.pipe;
struct pipe_surface templ;
/* We are going to reset this, so no point in refcounting */
templ.texture = res;
if (util_format_is_depth_or_stencil(format))
templ.format = nv50_blit_zeta_to_colour_format(format);
else
templ.format = format;
format = nv50_blit_zeta_to_colour_format(format);
templ.level = level;
templ.first_layer = templ.last_layer = layer;
/* this will be overwritten (not released) at the end of the blit */
nv50->framebuffer.cbufs[0] = (struct pipe_surface) {
.texture = res,
.format = format,
.level = level,
.first_layer = layer,
.last_layer = layer,
};
if (layer == -1) {
templ.first_layer = 0;
templ.last_layer =
nv50->framebuffer.cbufs[0].first_layer = 0;
nv50->framebuffer.cbufs[0].last_layer =
(res->target == PIPE_TEXTURE_3D ? res->depth0 : res->array_size) - 1;
}
nv50->fb_cbufs[0] = nv50_miptree_surface_new(pipe, res, &templ);
nv50->framebuffer.cbufs[0] = templ;
nv50->fb_cbufs[0] = nv50_miptree_surface_new(pipe, res, &nv50->framebuffer.cbufs[0]);
nv50->framebuffer.nr_cbufs = 1;
memset(&nv50->framebuffer.zsbuf, 0, sizeof(nv50->framebuffer.zsbuf));
nv50->fb_zsbuf = NULL;

24
src/gallium/drivers/nouveau/nvc0/nvc0_surface.c
View file

@ -962,26 +962,26 @@ nvc0_blit_set_dst(struct nvc0_blitctx *ctx,
{
struct nvc0_context *nvc0 = ctx->nvc0;
struct pipe_context *pipe = &nvc0->base.pipe;
struct pipe_surface templ;
/* We are going to reset this, so no point in refcounting */
templ.texture = res;
if (util_format_is_depth_or_stencil(format))
templ.format = nv50_blit_zeta_to_colour_format(format);
else
templ.format = format;
format = nv50_blit_zeta_to_colour_format(format);
templ.level = level;
templ.first_layer = templ.last_layer = layer;
/* this will be overwritten (not released) at the end of the blit */
nvc0->framebuffer.cbufs[0] = (struct pipe_surface) {
.texture = res,
.format = format,
.level = level,
.first_layer = layer,
.last_layer = layer,
};
if (layer == -1) {
templ.first_layer = 0;
templ.last_layer =
nvc0->framebuffer.cbufs[0].first_layer = 0;
nvc0->framebuffer.cbufs[0].last_layer =
(res->target == PIPE_TEXTURE_3D ? res->depth0 : res->array_size) - 1;
}
nvc0->framebuffer.cbufs[0] = templ;
nvc0->fb_cbufs[0] = nvc0_miptree_surface_new(pipe, res, &templ);
nvc0->fb_cbufs[0] = nvc0_miptree_surface_new(pipe, res, &nvc0->framebuffer.cbufs[0]);
nvc0->framebuffer.nr_cbufs = 1;
memset(&nvc0->framebuffer.zsbuf, 0, sizeof(nvc0->framebuffer.zsbuf));
pipe_surface_size(&nvc0->framebuffer.cbufs[0], &nvc0->framebuffer.width, &nvc0->framebuffer.height);