Attachment 122424 Details for Bug 94616 – 0001-i965-fix-invalid-memory-write.patch

0001-i965-fix-invalid-memory-write.patch

0001-i965-fix-invalid-memory-write.patch (text/plain), 3.45 KB, created by Marc-Andre Lureau on 2016-03-18 19:08:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marc-Andre Lureau

Created: 2016-03-18 19:08:20 UTC

Size: 3.45 KB

patch

obsolete

>From 2116fb478e7e6a6bcfbf7471410639557a9c8501 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
>Date: Fri, 18 Mar 2016 20:01:07 +0100
>Subject: [PATCH] i965: fix invalid memory write
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>I noticed some heap corruption running virgl tests, and valgrind
>helped me to track it down to the following error:
>
>==29272== Invalid write of size 4
>==29272==    at 0x90283D4: push_loop_stack (brw_eu_emit.c:1307)
>==29272==    by 0x9029A7D: brw_DO (brw_eu_emit.c:1750)
>==29272==    by 0x90554B0: fs_generator::generate_code(cfg_t const*, int) (brw_fs_generator.cpp:1999)
>==29272==    by 0x904491F: brw_compile_fs (brw_fs.cpp:5685)
>==29272==    by 0x8FC5DC5: brw_codegen_wm_prog (brw_wm.c:137)
>==29272==    by 0x8FC7663: brw_fs_precompile (brw_wm.c:638)
>==29272==    by 0x8FA4040: brw_shader_precompile(gl_context*, gl_shader_program*) (brw_link.cpp:51)
>==29272==    by 0x8FA4A9A: brw_link_shader (brw_link.cpp:260)
>==29272==    by 0x8DEF751: _mesa_glsl_link_shader (ir_to_mesa.cpp:3006)
>==29272==    by 0x8C84325: _mesa_link_program (shaderapi.c:1042)
>==29272==    by 0x8C851D7: _mesa_LinkProgram (shaderapi.c:1515)
>==29272==    by 0x4E4B8E8: add_shader_program (vrend_renderer.c:880)
>==29272==  Address 0xf2f3cb0 is 0 bytes after a block of size 112 alloc'd
>==29272==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
>==29272==    by 0x8ED11F7: ralloc_size (ralloc.c:113)
>==29272==    by 0x8ED1282: rzalloc_size (ralloc.c:134)
>==29272==    by 0x8ED14C0: rzalloc_array_size (ralloc.c:196)
>==29272==    by 0x9019C7B: brw_init_codegen (brw_eu.c:291)
>==29272==    by 0x904F565: fs_generator::fs_generator(brw_compiler const*, void*, void*, void const*, brw_stage_prog_data*, unsigned int, bool, gl_shader_stage) (brw_fs_generator.cpp:124)
>==29272==    by 0x9044883: brw_compile_fs (brw_fs.cpp:5675)
>==29272==    by 0x8FC5DC5: brw_codegen_wm_prog (brw_wm.c:137)
>==29272==    by 0x8FC7663: brw_fs_precompile (brw_wm.c:638)
>==29272==    by 0x8FA4040: brw_shader_precompile(gl_context*, gl_shader_program*) (brw_link.cpp:51)
>==29272==    by 0x8FA4A9A: brw_link_shader (brw_link.cpp:260)
>==29272==    by 0x8DEF751: _mesa_glsl_link_shader (ir_to_mesa.cpp:3006)
>
>if_depth_in_loop is an array of size p->loop_stack_array_size, and
>push_loop_stack() will access if_depth_in_loop[p->loop_stack_depth+1],
>thus the condition to grow the array should be
>p->loop_stack_array_size <= (p->loop_stack_depth + 1) (it's currently
>off by 2...)
>
>This can be reproduced by running the following test with virgl test
>server:
>LIBGL_ALWAYS_SOFTWARE=y GALLIUM_DRIVER=virpipe bin/shader_runner
>./tests/shaders/glsl-fs-unroll-explosion.shader_test -auto
>
>Signed-off-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
>---
> src/mesa/drivers/dri/i965/brw_eu_emit.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/src/mesa/drivers/dri/i965/brw_eu_emit.c b/src/mesa/drivers/dri/i965/brw_eu_emit.c
>index 0b99356..5b14252 100644
>--- a/src/mesa/drivers/dri/i965/brw_eu_emit.c
>+++ b/src/mesa/drivers/dri/i965/brw_eu_emit.c
>@@ -1294,7 +1294,7 @@ pop_if_stack(struct brw_codegen *p)
> static void
> push_loop_stack(struct brw_codegen *p, brw_inst *inst)
> {
>-   if (p->loop_stack_array_size < p->loop_stack_depth) {
>+   if (p->loop_stack_array_size <= (p->loop_stack_depth + 1)) {
>       p->loop_stack_array_size *= 2;
>       p->loop_stack = reralloc(p->mem_ctx, p->loop_stack, int,
> 			       p->loop_stack_array_size);
>-- 
>2.5.0
>

Actions: View

Attachments on bug 94616: 122424

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.