diff options
| author | Ilia Mirkin <[email protected]> | 2016-03-19 11:43:37 -0400 |
|---|---|---|
| committer | Ilia Mirkin <[email protected]> | 2016-03-19 13:09:49 -0400 |
| commit | d1b85dbffa0eec2b44bb2a9f339a2617a39730da (patch) | |
| tree | c28234809506f7dbac3452a7922ce78ffa409e2d /src/gallium/drivers/nouveau/nv50/nv50_state.c | |
| parent | 902bbda81b31bacb2a8c60ca6a8ba8ca34ae73d3 (diff) | |
nv50: reset TFB bufctx when we no longer hold a reference to the buffers
This fix is analogous to commit ff085d014.
This fixes some use-after-free situations in dEQP when an xfb state is
removed, and then a clear is triggered, which only does a partial
validation. It would attempt to read the no-longer-valid buffers,
resulting in crashes.
Signed-off-by: Ilia Mirkin <[email protected]>
Reviewed-by: Samuel Pitoiset <[email protected]>
Cc: "11.1 11.2" <[email protected]>
Diffstat (limited to 'src/gallium/drivers/nouveau/nv50/nv50_state.c')
| -rw-r--r-- | src/gallium/drivers/nouveau/nv50/nv50_state.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_state.c b/src/gallium/drivers/nouveau/nv50/nv50_state.c index 4d77bf1f711..86e74d68b11 100644 --- a/src/gallium/drivers/nouveau/nv50/nv50_state.c +++ b/src/gallium/drivers/nouveau/nv50/nv50_state.c @@ -1180,8 +1180,10 @@ nv50_set_stream_output_targets(struct pipe_context *pipe, } nv50->num_so_targets = num_targets; - if (nv50->so_targets_dirty) + if (nv50->so_targets_dirty) { + nouveau_bufctx_reset(nv50->bufctx_3d, NV50_BIND_3D_SO); nv50->dirty_3d |= NV50_NEW_3D_STRMOUT; + } } static void |