| Summary: | Read out of bounds in swizzle_for_size() (MesaLib/src/mesa/program/ir_to_mesa.cpp) | ||
|---|---|---|---|
| Product: | Mesa | Reporter: | Alexander Potapenko <glider> |
| Component: | Mesa core | Assignee: | mesa-dev |
| Status: | RESOLVED DUPLICATE | QA Contact: | |
| Severity: | normal | ||
| Priority: | medium | ||
| Version: | 7.9 | ||
| Hardware: | Other | ||
| OS: | Linux (All) | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
|
Description
Alexander Potapenko
2012-07-31 09:55:13 UTC
The swizzle_for_size() function is (unchanged from Mesa 7.9 to today):
static int
swizzle_for_size(int size)
{
int size_swizzles[4] = {
MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_X, SWIZZLE_X, SWIZZLE_X),
MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Y, SWIZZLE_Y),
MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Z, SWIZZLE_Z),
MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Z, SWIZZLE_W),
};
assert((size >= 1) && (size <= 4));
return size_swizzles[size - 1];
}
My guess is that if something's going wrong, you're running a non-debug build and the assertion is a no-op. Can you rebuild Mesa for debugging and retest? If you can find the value of 'size' for this failure, that'd be helpful.
Is there a way to have AddressSanitizer drop into a debugger (like --db-attach=yes in Valgrind) when it hits an error? It would be interesting to go up to the topmost ir_to_mesa_visitor::visit(ir_dereference_record*) frame and print ir->type->name. It seems like the only way this could happen is if either is_scalar or is_vector is true and vector_elements is zero. I've managed to reproduce this locally.
Inserting fprintf() calls into third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp shows that swizzle_for_size(0) is really called for some ir type named Nesting2:
ir->type->name: Nesting2
swizzle_for_size(0)
=================================================================
==5641== ERROR: AddressSanitizer global-buffer-overflow on address 0x7fcd7760bc7c at pc 0x7fcd771ed9b3 bp 0x7fff035d6e10 sp 0x7fff035d6e08
READ of size 4 at 0x7fcd7760bc7c thread T0
#0 0x7fcd771ed9b2 in swizzle_for_size(int) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:319
#1 0x7fcd771ed701 in ir_to_mesa_visitor::visit(ir_dereference_record*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1547
#2 0x7fcd771edadd in ir_to_mesa_visitor::visit(ir_assignment*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1591
#3 0x7fcd771dca42 in ir_to_mesa_visitor::visit(ir_function*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1020
#4 0x7fcd77412d29 in visit_exec_list(exec_list*, ir_visitor*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/glsl/ir.cpp:1200
...
Please let me know how else I can help.
In order to attach the debugger to a program instrumented with ASan one needs to run it with ASAN_OPTIONS=sleep_before_dying=100 (which means sleep for 100 seconds) and then attach gdb to the PID obtained from the log. This bug was already fixed on the 7.9 branch by the commit listed below. I similar patch is also on the 7.10. You just need to update... and I recommend updating to either 8.0.x or 9.0. The 7.x release series is no longer actively supported. commit 0d98ceb4bfc9f0ac5462e060fa1d66c9b8b7d031 Author: Ian Romanick <ian.d.romanick@intel.com> Date: Mon Dec 13 15:42:46 2010 -0800 ir_to_mesa: Don't generate swizzles for record derefs of non-scalar/vectors This is the same as what the array dereference handler does. Fixes piglit test glsl-link-struct-array (bugzilla #31648). NOTE: This is a candidate for the 7.9 and 7.10 branches. (cherry picked from commit 2d577ee730c30caacf711babde6542766aa0b655) *** This bug has been marked as a duplicate of bug 31648 *** |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.