From e16c8cc57910770379ed58510f9ed70bab86c5a4 Mon Sep 17 00:00:00 2001 From: Adam Simpkins Date: Sat, 28 Mar 2026 12:59:32 -0700 Subject: [PATCH] iris: fix a crash in disable_rb_aux_buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I have been running into crashes in this function when using blender. Some of the entries in ice->state.framebuffer.base.cbufs[0] can apparently have the texture field be null, which was causing a segfault in this loop. In my case, nr_cbufs was 3, and the first two cbufs entries had a null texture and format set to PIPE_FORMAT_NONE. The last entry had format of PIPE_FORMAT_R16G16_FLOAT and a non-null texture. Adding this null check before attempting to dereference the texture fixes the crash for me and allows blender to work normally. Fixes: ca96f8517cc ("iris: remove uses of pipe_surface as a pointer") Reviewed-by: Tapani Pälli Part-of: --- src/gallium/drivers/iris/iris_resolve.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/gallium/drivers/iris/iris_resolve.c b/src/gallium/drivers/iris/iris_resolve.c index 1911a288f7d..57c29326638 100644 --- a/src/gallium/drivers/iris/iris_resolve.c +++ b/src/gallium/drivers/iris/iris_resolve.c @@ -42,7 +42,8 @@ disable_rb_aux_buffer(struct iris_context *ice, struct pipe_surface *surf = &cso_fb->base.cbufs[i]; struct iris_resource *rb_res = (void *) surf->texture; - if (rb_res->bo == tex_res->bo && + if (rb_res != NULL && + rb_res->bo == tex_res->bo && surf->level >= min_level && surf->level < min_level + num_levels) { found = draw_aux_buffer_disabled[i] = true;