From c900cca96c4cf6766f5b855e07a0ea4d2584bf22 Mon Sep 17 00:00:00 2001 From: Mike Blumenkrantz Date: Tue, 30 Jan 2024 07:47:45 -0500 Subject: [PATCH] zink: always map descriptor buffers as COHERENT this is already implied since the buffers must be BAR-allocated, but it ensures the context isn't accessed during unmap Fixes: b06f6e00fba ("zink: fix heap-use-after-free on batch_state with sub-allocated pipe_resources") Part-of: --- src/gallium/drivers/zink/zink_descriptors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gallium/drivers/zink/zink_descriptors.c b/src/gallium/drivers/zink/zink_descriptors.c index b7e0ded9ffc..1c3b3fe71be 100644 --- a/src/gallium/drivers/zink/zink_descriptors.c +++ b/src/gallium/drivers/zink/zink_descriptors.c @@ -1593,7 +1593,7 @@ zink_batch_descriptor_init(struct zink_screen *screen, struct zink_batch_state * if (!pres) return false; bs->dd.db = zink_resource(pres); - bs->dd.db_map = pipe_buffer_map(&bs->ctx->base, pres, PIPE_MAP_READ | PIPE_MAP_WRITE | PIPE_MAP_PERSISTENT | PIPE_MAP_THREAD_SAFE, &bs->dd.db_xfer); + bs->dd.db_map = pipe_buffer_map(&bs->ctx->base, pres, PIPE_MAP_READ | PIPE_MAP_WRITE | PIPE_MAP_PERSISTENT | PIPE_MAP_COHERENT | PIPE_MAP_THREAD_SAFE, &bs->dd.db_xfer); } return true; }