Module: Mesa
Branch: main
Commit: f2d76a576d524087e4aabdc4c1de25b456d1d420
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=f2d76a576d524087e4aabdc4c1de25b456d1d420

Author: Roland Scheidegger <[email protected]>
Date:   Fri Sep 24 17:57:05 2021 +0200

lavapipe: Fix crashes with transform feedback when using VK_WHOLE_SIZE

llvmpipe expects valid size parameter, and when just VK_WHOLE_SIZE is
passed very bad things can happen.
This was handled specially before, but got dropped when lavapipe was
converted to use the generated command queue.

Fixes: eb7eccc76f0a ("lavapipe: Use generated command queue code")
Reviewed-By: Mike Blumenkrantz <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13036>

---

 src/gallium/frontends/lavapipe/lvp_execute.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/gallium/frontends/lavapipe/lvp_execute.c 
b/src/gallium/frontends/lavapipe/lvp_execute.c
index c9f647614b0..36ab1d82980 100644
--- a/src/gallium/frontends/lavapipe/lvp_execute.c
+++ b/src/gallium/frontends/lavapipe/lvp_execute.c
@@ -3350,13 +3350,19 @@ static void 
handle_bind_transform_feedback_buffers(struct vk_cmd_queue_entry *cm
 
    for (unsigned i = 0; i < btfb->binding_count; i++) {
       int idx = i + btfb->first_binding;
+      uint32_t size;
+      if (btfb->sizes && btfb->sizes[i] != VK_WHOLE_SIZE)
+         size = btfb->sizes[i];
+      else
+         size = lvp_buffer_from_handle(btfb->buffers[i])->size - 
btfb->offsets[i];
+
       if (state->so_targets[idx])
          state->pctx->stream_output_target_destroy(state->pctx, 
state->so_targets[idx]);
 
       state->so_targets[idx] = 
state->pctx->create_stream_output_target(state->pctx,
                                                                         
lvp_buffer_from_handle(btfb->buffers[i])->bo,
                                                                         
btfb->offsets[i],
-                                                                        
btfb->sizes[i]);
+                                                                        size);
    }
    state->num_so_targets = btfb->first_binding + btfb->binding_count;
 }

Reply via email to