diff options
| author | Ilia Mirkin <[email protected]> | 2016-02-16 01:02:52 -0500 |
|---|---|---|
| committer | Emil Velikov <[email protected]> | 2016-03-12 01:16:49 +0000 |
| commit | 1e9d8fa8a81abd01d935d381a59ce87c91a595ea (patch) | |
| tree | 1796f9c890dcac90b6a94435b2d57a842ede37c1 /src | |
| parent | 580cab2d9958280227437c0b7209caf848582667 (diff) | |
nvc0: reset TFB bufctx when we no longer hold a reference to the buffers
This fixes some use-after-free situations in dEQP when an xfb state is
removed, and then a clear is triggered, which only does a partial
validation. It would attempt to read the no-longer-valid buffers,
resulting in crashes.
Signed-off-by: Ilia Mirkin <[email protected]>
Cc: "11.1 11.2" <[email protected]>
(cherry picked from commit ff085d014ed8ccce230769575e50924561218d98)
[Emil Velikov: s/NVC0_BIND_3D_TFB/NVC0_BIND_TFB/]
Signed-off-by: Emil Velikov <[email protected]>
Conflicts:
src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c
src/gallium/drivers/nouveau/nvc0/nvc0_state.c
Diffstat (limited to 'src')
| -rw-r--r-- | src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c | 1 | ||||
| -rw-r--r-- | src/gallium/drivers/nouveau/nvc0/nvc0_state.c | 4 |
2 files changed, 3 insertions, 2 deletions
diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c b/src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c index 382a18ef153..c0cd569696a 100644 --- a/src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c +++ b/src/gallium/drivers/nouveau/nvc0/nvc0_shader_state.c @@ -294,7 +294,6 @@ nvc0_tfb_validate(struct nvc0_context *nvc0) if (!(nvc0->dirty & NVC0_NEW_TFB_TARGETS)) return; - nouveau_bufctx_reset(nvc0->bufctx_3d, NVC0_BIND_TFB); for (b = 0; b < nvc0->num_tfbbufs; ++b) { struct nvc0_so_target *targ = nvc0_so_target(nvc0->tfbbuf[b]); diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_state.c b/src/gallium/drivers/nouveau/nvc0/nvc0_state.c index 9391ad6ec10..cd33b4b908b 100644 --- a/src/gallium/drivers/nouveau/nvc0/nvc0_state.c +++ b/src/gallium/drivers/nouveau/nvc0/nvc0_state.c @@ -1184,8 +1184,10 @@ nvc0_set_transform_feedback_targets(struct pipe_context *pipe, } nvc0->num_tfbbufs = num_targets; - if (nvc0->tfbbuf_dirty) + if (nvc0->tfbbuf_dirty) { + nouveau_bufctx_reset(nvc0->bufctx_3d, NVC0_BIND_TFB); nvc0->dirty |= NVC0_NEW_TFB_TARGETS; + } } static void |