panfrost: Remove vertex buffer offset from its size
authorAlyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Thu, 22 Aug 2019 15:02:52 +0000 (08:02 -0700)
committerAlyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Thu, 22 Aug 2019 20:31:39 +0000 (13:31 -0700)
The offset is added to the base address, so we need to subtract it from
the size to maintain the same end address and thus prevent a buffer
overflow:

   end_address = start_address + size

   start_address' = start_address + offset
   size' = size - offset

   end_address' = start_address' + size'
                = (start_address + offset) + (size - offset)
                = (start_address + size) + (offset - offset)
                = start_address + size
                = end_address

   QED.

Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
src/gallium/drivers/panfrost/pan_instancing.c

index 30023725b2e2a22c221e2e1cea97cb64596ed738..e5a1e7cfae30e1e14a5c0241554b0d9fd1c968c2 100644 (file)
@@ -292,7 +292,7 @@ panfrost_emit_vertex_data(struct panfrost_job *batch)
                  * will be adjusted back when we fixup the src_offset in
                  * mali_attr_meta */
 
-                mali_ptr raw_addr = panfrost_vertex_buffer_address(ctx, vbi);
+                mali_ptr raw_addr = rsrc->bo->gpu + buf->buffer_offset;
                 mali_ptr addr = raw_addr & ~63;
                 unsigned chopped_addr = raw_addr - addr;
 
@@ -302,7 +302,10 @@ panfrost_emit_vertex_data(struct panfrost_job *batch)
                 /* Set common fields */
                 attrs[k].elements = addr;
                 attrs[k].stride = buf->stride;
-                attrs[k].size = rsrc->base.width0;
+
+                /* Since we advanced the base pointer, we shrink the buffer
+                 * size */
+                attrs[k].size = rsrc->base.width0 - buf->buffer_offset;
 
                 /* We need to add the extra size we masked off (for
                  * correctness) so the data doesn't get clamped away */