From 99129b13ceacad903ac609b727acc1c061cb13ff Mon Sep 17 00:00:00 2001 From: Adam Simpkins Date: Sat, 28 Mar 2026 12:59:32 -0700 Subject: [PATCH] iris: fix a crash in disable_rb_aux_buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I have been running into crashes in this function when using blender. Some of the entries in ice->state.framebuffer.base.cbufs[0] can apparently have the texture field be null, which was causing a segfault in this loop. In my case, nr_cbufs was 3, and the first two cbufs entries had a null texture and format set to PIPE_FORMAT_NONE. The last entry had format of PIPE_FORMAT_R16G16_FLOAT and a non-null texture. Adding this null check before attempting to dereference the texture fixes the crash for me and allows blender to work normally. Fixes: ca96f8517cc ("iris: remove uses of pipe_surface as a pointer") Reviewed-by: Tapani Pälli (cherry picked from commit e16c8cc57910770379ed58510f9ed70bab86c5a4) Part-of: --- .pick_status.json | 2 +- src/gallium/drivers/iris/iris_resolve.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 7f539ba95f2..d47794938e1 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -904,7 +904,7 @@ "description": "iris: fix a crash in disable_rb_aux_buffer", "nominated": true, "nomination_type": 2, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "ca96f8517cc996915778c6d63d753f4cce63c555", "notes": null diff --git a/src/gallium/drivers/iris/iris_resolve.c b/src/gallium/drivers/iris/iris_resolve.c index 07df4932a23..d88db41a57d 100644 --- a/src/gallium/drivers/iris/iris_resolve.c +++ b/src/gallium/drivers/iris/iris_resolve.c @@ -61,7 +61,8 @@ disable_rb_aux_buffer(struct iris_context *ice, struct pipe_surface *surf = &cso_fb->base.cbufs[i]; struct iris_resource *rb_res = (void *) surf->texture; - if (rb_res->bo == tex_res->bo && + if (rb_res != NULL && + rb_res->bo == tex_res->bo && surf->level >= min_level && surf->level < min_level + num_levels) { found = draw_aux_buffer_disabled[i] = true;