Module: Mesa
Branch: 18.0
Commit: 251a36d629101e32da9026436954b0497bf7dbcc
URL:
http://cgit.freedesktop.org/mesa/mesa/commit/?id=251a36d629101e32da9026436954b0497bf7dbcc
Author: Kenneth Graunke <kenn...@whitecape.org>
Date: Fri Apr 13 11:48:06 2018 -0700
i965: Fix shadow batches to be the same size as the real BO.
brw_bo_alloc may round up our allocation size to the next bucket size.
In this case, we would malloc a shadow buffer that was the original
intended size, but use bo->size (the larger size) for all of our checks.
This could cause us to run off the end of the shadow buffer.
v2: Actually use the new BO size (caught by Lionel)
Reported-by: James Xiong <james.xi...@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwer...@intel.com>
Fixes: c7dcee58b5fe183e1653c13bff6a212f0d157b29 (i965: Avoid problems from
referencing orphaned BOs after growing.)
(cherry picked from commit da25ae92bebb8921003c0df30820d06a5f5e3fef)
---
src/mesa/drivers/dri/i965/intel_batchbuffer.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/mesa/drivers/dri/i965/intel_batchbuffer.c
b/src/mesa/drivers/dri/i965/intel_batchbuffer.c
index 4f324e2d7e..c56f5b8289 100644
--- a/src/mesa/drivers/dri/i965/intel_batchbuffer.c
+++ b/src/mesa/drivers/dri/i965/intel_batchbuffer.c
@@ -339,8 +339,11 @@ grow_buffer(struct brw_context *brw,
/* We can't safely use realloc, as it may move the existing buffer,
* breaking existing pointers the caller may still be using. Just
* malloc a new copy and memcpy it like the normal BO path.
+ *
+ * Use bo->size rather than new_size because the bufmgr may have
+ * rounded up the size, and we want the shadow size to match.
*/
- grow->map = malloc(new_size);
+ grow->map = malloc(new_bo->size);
} else {
grow->map = brw_bo_map(brw, new_bo, MAP_READ | MAP_WRITE);
}
_______________________________________________
mesa-commit mailing list
mesa-commit@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-commit
