If nvfx_framebuffer prepare and validate were called successively with fb->zsbuf not NULL and then NULL, nvfx->hw_zeta would contain garbage and this would cause failures in nvfx_framebuffer_relocate/OUT_RELOC(hw_zeta).
This was triggered by piglit/texwrap 2D GL_DEPTH_COMPONENT24 and caused first a 'write to user buffer!!' error in libdrm and then worse things. Signed-off-by: Xavier Chantry <[email protected]> --- src/gallium/drivers/nvfx/nvfx_state_fb.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/gallium/drivers/nvfx/nvfx_state_fb.c b/src/gallium/drivers/nvfx/nvfx_state_fb.c index 73885de..90eb110 100644 --- a/src/gallium/drivers/nvfx/nvfx_state_fb.c +++ b/src/gallium/drivers/nvfx/nvfx_state_fb.c @@ -113,7 +113,9 @@ nvfx_framebuffer_validate(struct nvfx_context *nvfx, unsigned prepare_result) nvfx->state.render_temps |= nvfx_surface_get_render_target(fb->cbufs[i], prepare_result, &nvfx->hw_rt[i]) << i; for(; i < 4; ++i) - nvfx->hw_rt[i].bo = 0; + nvfx->hw_rt[i].bo = NULL; + + nvfx->hw_zeta.bo = NULL; if (fb->zsbuf) { nvfx->state.render_temps |= nvfx_surface_get_render_target(fb->zsbuf, prepare_result, &nvfx->hw_zeta) << 7; -- 1.7.3.2 _______________________________________________ Nouveau mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/nouveau
