diff options
author | Kenneth Graunke <kenneth@whitecape.org> | 2018-04-13 11:48:06 -0700 |
---|---|---|
committer | Juan A. Suarez Romero <jasuarez@igalia.com> | 2018-04-23 09:56:53 +0000 |
commit | 251a36d629101e32da9026436954b0497bf7dbcc (patch) | |
tree | e647280d8132cd8175b57ec68a2e04994913abea | |
parent | b62b3eb2598d43fdd9f56ca3d49a41ca6703ccff (diff) | |
download | mesa-251a36d629101e32da9026436954b0497bf7dbcc.tar.gz |
i965: Fix shadow batches to be the same size as the real BO.
brw_bo_alloc may round up our allocation size to the next bucket size.
In this case, we would malloc a shadow buffer that was the original
intended size, but use bo->size (the larger size) for all of our checks.
This could cause us to run off the end of the shadow buffer.
v2: Actually use the new BO size (caught by Lionel)
Reported-by: James Xiong <james.xiong@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: c7dcee58b5fe183e1653c13bff6a212f0d157b29 (i965: Avoid problems from referencing orphaned BOs after growing.)
(cherry picked from commit da25ae92bebb8921003c0df30820d06a5f5e3fef)
-rw-r--r-- | src/mesa/drivers/dri/i965/intel_batchbuffer.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/i965/intel_batchbuffer.c b/src/mesa/drivers/dri/i965/intel_batchbuffer.c index 4f324e2d7e1..c56f5b82899 100644 --- a/src/mesa/drivers/dri/i965/intel_batchbuffer.c +++ b/src/mesa/drivers/dri/i965/intel_batchbuffer.c @@ -339,8 +339,11 @@ grow_buffer(struct brw_context *brw, /* We can't safely use realloc, as it may move the existing buffer, * breaking existing pointers the caller may still be using. Just * malloc a new copy and memcpy it like the normal BO path. + * + * Use bo->size rather than new_size because the bufmgr may have + * rounded up the size, and we want the shadow size to match. */ - grow->map = malloc(new_size); + grow->map = malloc(new_bo->size); } else { grow->map = brw_bo_map(brw, new_bo, MAP_READ | MAP_WRITE); } |