zink: always map descriptor buffers as COHERENT

this is already implied since the buffers must be BAR-allocated,
but it ensures the context isn't accessed during unmap

Fixes: b06f6e00fb ("zink: fix heap-use-after-free on batch_state with sub-allocated pipe_resources")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27344>
(cherry picked from commit c900cca96c)
This commit is contained in:
Mike Blumenkrantz
2024-01-30 07:47:45 -05:00
committed by Eric Engestrom
parent a33e2a4de7
commit abfb950aa8
2 changed files with 2 additions and 2 deletions

View File

@@ -494,7 +494,7 @@
"description": "zink: always map descriptor buffers as COHERENT",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "b06f6e00fba6e33c28a198a1bb14b89e9dfbb4ae",
"notes": null

View File

@@ -1593,7 +1593,7 @@ zink_batch_descriptor_init(struct zink_screen *screen, struct zink_batch_state *
if (!pres)
return false;
bs->dd.db = zink_resource(pres);
bs->dd.db_map = pipe_buffer_map(&bs->ctx->base, pres, PIPE_MAP_READ | PIPE_MAP_WRITE | PIPE_MAP_PERSISTENT | PIPE_MAP_THREAD_SAFE, &bs->dd.db_xfer);
bs->dd.db_map = pipe_buffer_map(&bs->ctx->base, pres, PIPE_MAP_READ | PIPE_MAP_WRITE | PIPE_MAP_PERSISTENT | PIPE_MAP_COHERENT | PIPE_MAP_THREAD_SAFE, &bs->dd.db_xfer);
}
return true;
}