From eb8017ca68fd23d7cafe45a1754a1fd65b42e815 Mon Sep 17 00:00:00 2001 From: "Juan A. Suarez Romero" Date: Wed, 19 Feb 2025 19:50:36 +0100 Subject: [PATCH] v3dv: duplicate key for texel_buffer cache We can't use the local variable key to insert in the hashtable, as the key needs to be persistent for future searches. This makes a copy of the key in the pipeline, which is kept persistent in the hashtable. This fixes a stack-buffer-overflow. Backport-to: 25.0 Reviewed-by: Jose Maria Casanova Crespo Reviewed-by: Iago Toral Quiroga Signed-off-by: Juan A. Suarez Romero Part-of: --- src/broadcom/vulkan/v3dv_meta_copy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/broadcom/vulkan/v3dv_meta_copy.c b/src/broadcom/vulkan/v3dv_meta_copy.c index f6bba111395..3770b65c8d1 100644 --- a/src/broadcom/vulkan/v3dv_meta_copy.c +++ b/src/broadcom/vulkan/v3dv_meta_copy.c @@ -2535,8 +2535,9 @@ get_copy_texel_buffer_pipeline( goto fail; if (device->instance->meta_cache_enabled) { + memcpy((*pipeline)->key, key, sizeof((*pipeline)->key)); _mesa_hash_table_insert(device->meta.texel_buffer_copy.cache[image_type], - key, *pipeline); + &(*pipeline)->key, *pipeline); mtx_unlock(&device->meta.mtx); } else { v3dv_cmd_buffer_add_private_obj(