[Mesa-dev] [PATCH] radv/xfb: fix counter buffer bounds checks.

2018-12-12 Thread Dave Airlie 
From: Dave Airlie 

If we gave this function 0 counter buffers, we'd still try and
access pCounterBuffers[0] as this check was incorrect.

Fixes crash with ext_transform_feedback-pipeline-basic-primgen
on zink on radv.

Fixes: 677b496b6 (radv: fix begin/end transform feedback with 0 counter 
buffers.)
Signed-off-by: Dave Airlie 
---
 src/amd/vulkan/radv_cmd_buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/amd/vulkan/radv_cmd_buffer.c b/src/amd/vulkan/radv_cmd_buffer.c
index 23909a0f7dd..e08d37ee1f2 100644
--- a/src/amd/vulkan/radv_cmd_buffer.c
+++ b/src/amd/vulkan/radv_cmd_buffer.c
@@ -4830,7 +4830,7 @@ void radv_CmdBeginTransformFeedbackEXT(
assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
for_each_bit(i, so->enabled_mask) {
int32_t counter_buffer_idx = i - firstCounterBuffer;
-   if (counter_buffer_idx >= 0 && counter_buffer_idx > 
counterBufferCount)
+   if (counter_buffer_idx >= 0 && counter_buffer_idx >= 
counterBufferCount)
counter_buffer_idx = -1;
 
/* SI binds streamout buffers as shader resources.
@@ -4892,7 +4892,7 @@ void radv_CmdEndTransformFeedbackEXT(
assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
for_each_bit(i, so->enabled_mask) {
int32_t counter_buffer_idx = i - firstCounterBuffer;
-   if (counter_buffer_idx >= 0 && counter_buffer_idx > 
counterBufferCount)
+   if (counter_buffer_idx >= 0 && counter_buffer_idx >= 
counterBufferCount)
counter_buffer_idx = -1;
 
if (counter_buffer_idx >= 0 && pCounterBuffers && 
pCounterBuffers[counter_buffer_idx]) {
-- 
2.17.2

___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev

Re: [Mesa-dev] [PATCH] radv/xfb: fix counter buffer bounds checks.

2018-12-13 Thread Samuel Pitoiset 

Reviewed-by: Samuel Pitoiset 

On 12/13/18 4:32 AM, Dave Airlie wrote:

From: Dave Airlie 

If we gave this function 0 counter buffers, we'd still try and
access pCounterBuffers[0] as this check was incorrect.

Fixes crash with ext_transform_feedback-pipeline-basic-primgen
on zink on radv.

Fixes: 677b496b6 (radv: fix begin/end transform feedback with 0 counter 
buffers.)
Signed-off-by: Dave Airlie 
---
  src/amd/vulkan/radv_cmd_buffer.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/amd/vulkan/radv_cmd_buffer.c b/src/amd/vulkan/radv_cmd_buffer.c
index 23909a0f7dd..e08d37ee1f2 100644
--- a/src/amd/vulkan/radv_cmd_buffer.c
+++ b/src/amd/vulkan/radv_cmd_buffer.c
@@ -4830,7 +4830,7 @@ void radv_CmdBeginTransformFeedbackEXT(
assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
for_each_bit(i, so->enabled_mask) {
int32_t counter_buffer_idx = i - firstCounterBuffer;
-   if (counter_buffer_idx >= 0 && counter_buffer_idx > 
counterBufferCount)
+   if (counter_buffer_idx >= 0 && counter_buffer_idx >= 
counterBufferCount)
counter_buffer_idx = -1;
  
  		/* SI binds streamout buffers as shader resources.

@@ -4892,7 +4892,7 @@ void radv_CmdEndTransformFeedbackEXT(
assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
for_each_bit(i, so->enabled_mask) {
int32_t counter_buffer_idx = i - firstCounterBuffer;
-   if (counter_buffer_idx >= 0 && counter_buffer_idx > 
counterBufferCount)
+   if (counter_buffer_idx >= 0 && counter_buffer_idx >= 
counterBufferCount)
counter_buffer_idx = -1;
  
  		if (counter_buffer_idx >= 0 && pCounterBuffers && pCounterBuffers[counter_buffer_idx]) {



___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev