OpenHarmony/third_party_mesa3d
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

panfrost: Don't crash on panfrost_bo_create() with size==0 invocation

Browse Source 
1. Clamp bucket_index from both ends to avoid returning negative index.
2. Return NULL in case BO allocation/fetching failure to prevent invalid
   bo mapping.

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6247
Signed-off-by: Roman Stratiienko <r.stratiienko@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/15748>
This commit is contained in:
Roman Stratiienko
2022-04-04 20:52:59 +03:00
parent 576833507b
commit 61f94fff0d
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/panfrost/lib/pan_bo.c
View File

@@ -165,13 +165,8 @@ pan_bucket_index(unsigned size)
/* Clamp the bucket index; all huge allocations will be
* sorted into the largest bucket */
bucket_index = MIN2(bucket_index, MAX_BO_CACHE_BUCKET);
/* The minimum bucket size must equal the minimum allocation
* size; the maximum we clamped */
assert(bucket_index >= MIN_BO_CACHE_BUCKET);
assert(bucket_index <= MAX_BO_CACHE_BUCKET);
bucket_index = CLAMP(bucket_index, MIN_BO_CACHE_BUCKET,
MAX_BO_CACHE_BUCKET);
/* Reindex from 0 */
return (bucket_index - MIN_BO_CACHE_BUCKET);
@@ -397,11 +392,13 @@ panfrost_bo_create(struct panfrost_device *dev, size_t size,
if (!bo)
bo = panfrost_bo_cache_fetch(dev, size, flags, label, false);
if (!bo)
fprintf(stderr, "BO creation failed\n");
assert(bo);
if (!bo) {
fprintf(stderr, "BO creation failed\n");
return NULL;
}
/* Only mmap now if we know we need to. For CPU-invisible buffers, we
* never map since we don't care about their contents; they're purely
* for GPU-internal use. But we do trace them anyway. */