fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-13 22:50:26 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

anv: Protect against OOB access to anv_state_pool::buckets

Browse source 
Suggested-by: Paulo Zanoni
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: mesa-stable
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/30751>
(cherry picked from commit 0921dfa044)
This commit is contained in:
Ian Romanick 2024-08-20 16:43:59 -07:00 • committed by Eric Engestrom
parent 0f82e06741
commit ee320276cd
2 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -54,7 +54,7 @@
"description": "anv: Protect against OOB access to anv_state_pool::buckets",
"nominated": true,
"nomination_type": 0,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": null,
"notes": null

10
src/intel/vulkan/anv_allocator.c
View file

@ -777,6 +777,10 @@ anv_state_pool_return_blocks(struct anv_state_pool *pool,
}
uint32_t block_bucket = anv_state_pool_get_bucket(block_size);
if (block_bucket >= ARRAY_SIZE(pool->buckets))
return;
anv_free_list_push(&pool->buckets[block_bucket].free_list,
&pool->table, st_idx, count);
}
@ -839,6 +843,9 @@ anv_state_pool_alloc_no_vg(struct anv_state_pool *pool,
{
uint32_t bucket = anv_state_pool_get_bucket(MAX2(size, align));
if (bucket >= ARRAY_SIZE(pool->buckets))
return ANV_STATE_NULL;
struct anv_state *state;
uint32_t alloc_size = anv_state_pool_get_bucket_size(bucket);
int64_t offset;
@ -949,6 +956,9 @@ anv_state_pool_free_no_vg(struct anv_state_pool *pool, struct anv_state state)
assert(state.offset >= pool->start_offset);
if (bucket >= ARRAY_SIZE(pool->buckets))
return;
anv_free_list_push(&pool->buckets[bucket].free_list,
&pool->table, state.idx, 1);
}