fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-29 20:20:24 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

nvc0: reset TFB bufctx when we no longer hold a reference to the buffers

Browse source 
This fixes some use-after-free situations in dEQP when an xfb state is
removed, and then a clear is triggered, which only does a partial
validation. It would attempt to read the no-longer-valid buffers,
resulting in crashes.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org>
(cherry picked from commit ff085d014e)
[Emil Velikov: macro names do not need 3D_ ]
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>

Conflicts:
    src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c
    src/gallium/drivers/nouveau/nvc0/nvc0_state.c
This commit is contained in:
Ilia Mirkin 2016-02-16 01:02:52 -05:00 • committed by Emil Velikov
parent 4a6aa3d978
commit b2ac03a8fc
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c
View file

@ -297,7 +297,6 @@ nvc0_tfb_validate(struct nvc0_context *nvc0)
if (!(nvc0->dirty & NVC0_NEW_TFB_TARGETS))
return;
nouveau_bufctx_reset(nvc0->bufctx_3d, NVC0_BIND_TFB);
for (b = 0; b < nvc0->num_tfbbufs; ++b) {
struct nvc0_so_target *targ = nvc0_so_target(nvc0->tfbbuf[b]);

4
src/gallium/drivers/nouveau/nvc0/nvc0_state.c
View file

@ -1157,8 +1157,10 @@ nvc0_set_transform_feedback_targets(struct pipe_context *pipe,
}
nvc0->num_tfbbufs = num_targets;
if (nvc0->tfbbuf_dirty)
if (nvc0->tfbbuf_dirty) {
nouveau_bufctx_reset(nvc0->bufctx_3d, NVC0_BIND_TFB);
nvc0->dirty |= NVC0_NEW_TFB_TARGETS;
}
}
static void