Find a file
Alyssa Rosenzweig b475bf8f26 nir/sweep: fix use-after-free with dominance LCA
Either we need to save this pointer or toss it.

==146166==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bfe77013920 at pc 0x7b9e6fd5b978 bp 0x7ffc30ef18e0 sp 0x7ffc30ef18d8
READ of size 4 at 0x7bfe77013920 thread T0
    #0 0x7b9e6fd5b977 in get_header ../src/util/ralloc.c:83
    #1 0x7b9e6fd5b977 in ralloc_parent ../src/util/ralloc.c:382
    #2 0x7b9e6fd5b977 in reralloc_size ../src/util/ralloc.c:198
    #3 0x7b9e6fd5b977 in reralloc_array_size ../src/util/ralloc.c:241
    #4 0x7b9e705f83c2 in range_minimum_query_table_resize ../src/util/range_minimum_query.c:21
    #5 0x7b9e7018af1d in realloc_info ../src/compiler/nir/nir_dominance_lca.c:33
    #6 0x7b9e7018af1d in nir_calc_dominance_lca_impl ../src/compiler/nir/nir_dominance_lca.c:126
    #7 0x7b9e6ff9815c in nir_metadata_require ../src/compiler/nir/nir_metadata.c:42
    #8 0x7b9e6ff998e4 in nir_metadata_require_most ../src/compiler/nir/nir_metadata.c:200
    #9 0x7b9e6f8aab4d in st_finalize_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:735
    #10 0x7b9e6f0afb14 in st_create_common_variant ../src/mesa/state_tracker/st_program.c:858
    #11 0x7b9e6f0be2d3 in st_get_common_variant ../src/mesa/state_tracker/st_program.c:973
    #12 0x7b9e6f0bf9cf in st_precompile_shader_variant ../src/mesa/state_tracker/st_program.c:1478
    #13 0x7b9e6f0bf9cf in st_finalize_program ../src/mesa/state_tracker/st_program.c:1596
    #14 0x7b9e6f8b0127 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:633
    #15 0x7b9e6f8b3611 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:816
    #16 0x7b9e6f7bcf51 in link_program ../src/mesa/main/shaderapi.c:1412
    #17 0x7b9e6f7bcf51 in link_program_error ../src/mesa/main/shaderapi.c:1474
    #18 0x0000004020b0 in main._omp_fn.0 /home/alyssa/shader-db/run.c:872
    #19 0x7f9e7893dd65 in GOMP_parallel (/lib64/libgomp.so.1+0xdd65) (BuildId: 9cc501fdca53b5d4ab094f709486781c98573bc9)
    #20 0x000000400d6a in main /home/alyssa/shader-db/run.c:689
    #21 0x7f9e78011574 in __libc_start_call_main (/lib64/libc.so.6+0x3574) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
    #22 0x7f9e78011627 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3627) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
    #23 0x000000401014 in _start (/home/alyssa/shader-db/run+0x401014) (BuildId: a83b8d830cc265be3f54ea3e7a21a0fb5156624b)

0x7bfe77013920 is located 0 bytes inside of 64-byte region [0x7bfe77013920,0x7bfe77013960)
freed by thread T0 here:
    #0 0x7f9e782e5beb in free.part.0 (/usr/lib64/libasan.so.8+0xe5beb) (BuildId: cab80046dbc1c97c6e14490acc37d079701f8d9a)
    #1 0x7b9e6fd5bc39 in unsafe_free ../src/util/ralloc.c:319
    #2 0x7b9e6fd5bc39 in ralloc_free ../src/util/ralloc.c:264
    #3 0x7b9e70063d81 in nir_sweep ../src/compiler/nir/nir_sweep.c:219
    #4 0x7b9e6f0bf499 in st_finalize_program ../src/mesa/state_tracker/st_program.c:1585
    #5 0x7b9e6f8b0127 in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:633
    #6 0x7b9e6f8b3611 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:816
    #7 0x7b9e6f7bcf51 in link_program ../src/mesa/main/shaderapi.c:1412
    #8 0x7b9e6f7bcf51 in link_program_error ../src/mesa/main/shaderapi.c:1474
    #9 0x0000004020b0 in main._omp_fn.0 /home/alyssa/shader-db/run.c:872

previously allocated by thread T0 here:
    #0 0x7f9e782e5e4b in realloc.part.0 (/usr/lib64/libasan.so.8+0xe5e4b) (BuildId: cab80046dbc1c97c6e14490acc37d079701f8d9a)
    #1 0x7b9e6fd5a883 in resize ../src/util/ralloc.c:167
    #2 0x7b9e705f83c2 in range_minimum_query_table_resize ../src/util/range_minimum_query.c:21
    #3 0x7b9e7018af1d in realloc_info ../src/compiler/nir/nir_dominance_lca.c:33
    #4 0x7b9e7018af1d in nir_calc_dominance_lca_impl ../src/compiler/nir/nir_dominance_lca.c:126
    #5 0x7b9e6ff9815c in nir_metadata_require ../src/compiler/nir/nir_metadata.c:42
    #6 0x7b9e6ff998e4 in nir_metadata_require_most ../src/compiler/nir/nir_metadata.c:200
    #7 0x7b9e6f8b0ede in st_link_glsl_to_nir ../src/mesa/state_tracker/st_glsl_to_nir.cpp:550
    #8 0x7b9e6f8b3611 in st_link_shader ../src/mesa/state_tracker/st_glsl_to_nir.cpp:816
    #9 0x7b9e6f7bcf51 in link_program ../src/mesa/main/shaderapi.c:1412
    #10 0x7b9e6f7bcf51 in link_program_error ../src/mesa/main/shaderapi.c:1474
    #11 0x0000004020b0 in main._omp_fn.0 /home/alyssa/shader-db/run.c:872

Fixes: 17876a00af ("nir: Add a faster lowest common ancestor algorithm")
Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@intel.com>
Reviewed-by: Mel Henning <mhenning@darkrefraction.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
(cherry picked from commit 65fcdf4c81)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38803>
2025-11-17 09:54:26 -08:00
.ci-farms Revert "ci: disable Collabora's farm due to maintenance" 2025-10-06 13:00:52 +02:00
.ci-farms-disabled Revert "ci: disable Collabora's farm due to maintenance" 2025-10-06 13:00:52 +02:00
.github/workflows meson: remove unused osmesa option 2025-06-23 06:42:50 +00:00
.gitlab docs: update gitlab docs urls 2025-02-23 00:31:59 +01:00
.gitlab-ci ci: drop google-freedreno remnants 2025-11-13 08:10:34 -08:00
.marge/hooks ci: pipeline_message: reset empty errors 2025-01-07 05:08:10 +00:00
android android: fix building rules for i915, r300 2025-10-08 23:43:33 +02:00
bin ci: Add missing aiohttp Python dependecy 2025-10-15 23:48:53 +00:00
build-support meson: move tsan-blacklist.txt to build-support with the other build support files 2024-05-01 07:05:12 +00:00
docs docs: Add sha sums for 25.3.0 2025-11-14 13:56:23 -08:00
include drm-uapi: Import the new NVIDIA modifiers 2025-11-13 08:10:17 -08:00
licenses licenses: add missing licenses 2025-01-08 20:37:51 +00:00
src nir/sweep: fix use-after-free with dominance LCA 2025-11-17 09:54:26 -08:00
subprojects ci: Bump DirectX-Headers and Agility SDK dependencies to 1.618.1 2025-10-01 14:46:15 -04:00
.clang-format meson: enable the clang-format target 2023-05-29 11:57:08 +00:00
.clang-format-ignore ci: enforce formatting for RADV & ACO 2023-06-16 19:59:52 +00:00
.clang-format-include ethos: Initial commit of a driver for the Arm Ethos-U65 NPU. 2025-10-15 20:10:15 +00:00
.dir-locals.el
.editorconfig editorconfig: move OpenCL configuration to root 2025-08-30 22:49:08 -07:00
.git-blame-ignore-revs freedreno: Add register renaming to .git-blame-ignore-revs 2025-07-03 12:50:04 +00:00
.gitattributes gitlab: Highlight .cl as C 2023-11-02 11:37:46 +00:00
.gitignore intel/mda: Add code to produce mesa debug archives 2025-09-24 23:08:45 -07:00
.gitlab-ci.yml ci: Disable broken MR check in sanity job 2025-10-09 09:05:56 +00:00
.graphqlrc.yml
.mailmap mailmap: Update for Dylan Baker 2025-09-16 19:45:15 +00:00
.mr-label-maker.yml mr-label-maker.yml: remove remaining osmesa occurrences 2025-06-23 06:42:50 +00:00
.pick_status.json nir/sweep: fix use-after-free with dominance LCA 2025-11-17 09:54:26 -08:00
.shellcheckrc ci: move shellcheck options to .shellcheckrc 2024-10-24 22:43:03 +00:00
CODEOWNERS intel: update code owners 2025-08-31 15:38:27 +00:00
meson.build meson: require sysprof-capture-4 >= 4.49.0 2025-11-13 08:10:35 -08:00
meson.options ethos: Initial commit of a driver for the Arm Ethos-U65 NPU. 2025-10-15 20:10:15 +00:00
README.rst docs: Match README installation guide with meson.rst 2024-07-27 11:53:53 +00:00
rustfmt.toml mesa: Add rustfmt.toml 2024-11-18 22:29:14 +00:00
VERSION VERSION: bump for 25.3.0 2025-11-14 13:25:42 -08:00

`Mesa <https://mesa3d.org>`_ - The 3D Graphics Library
======================================================


Source
------

This repository lives at https://gitlab.freedesktop.org/mesa/mesa.
Other repositories are likely forks, and code found there is not supported.


Build & install
---------------

You can find more information in our documentation (`docs/install.rst
<https://docs.mesa3d.org/install.html>`_), but the recommended way is to use
Meson (`docs/meson.rst <https://docs.mesa3d.org/meson.html>`_):

.. code-block:: sh

  $ meson setup build
  $ ninja -C build/
  $ sudo ninja -C build/ install

Support
-------

Many Mesa devs hang on IRC; if you're not sure which channel is
appropriate, you should ask your question on `OFTC's #dri-devel
<irc://irc.oftc.net/dri-devel>`_, someone will redirect you if
necessary.
Remember that not everyone is in the same timezone as you, so it might
take a while before someone qualified sees your question.
To figure out who you're talking to, or which nick to ping for your
question, check out `Who's Who on IRC
<https://dri.freedesktop.org/wiki/WhosWho/>`_.

The next best option is to ask your question in an email to the
mailing lists: `mesa-dev\@lists.freedesktop.org
<https://lists.freedesktop.org/mailman/listinfo/mesa-dev>`_


Bug reports
-----------

If you think something isn't working properly, please file a bug report
(`docs/bugs.rst <https://docs.mesa3d.org/bugs.html>`_).


Contributing
------------

Contributions are welcome, and step-by-step instructions can be found in our
documentation (`docs/submittingpatches.rst
<https://docs.mesa3d.org/submittingpatches.html>`_).

Note that Mesa uses gitlab for patches submission, review and discussions.