From: Kenneth Graunke <kenneth@whitecape.org>
Date: Mon, 22 Oct 2018 21:35:33 +0000 (-0700)
Subject: iris: Clamp UBO and SSBO access to the actual BO size, for safety
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=ba2a4207f91bc5e5af0fdbff72c57fd0c5b8d4e7;p=mesa.git

iris: Clamp UBO and SSBO access to the actual BO size, for safety
---

diff --git a/src/gallium/drivers/iris/iris_state.c b/src/gallium/drivers/iris/iris_state.c
index de4adffce9d..e3ae6a6fceb 100644
--- a/src/gallium/drivers/iris/iris_state.c
+++ b/src/gallium/drivers/iris/iris_state.c
@@ -2112,7 +2112,8 @@ iris_set_constant_buffer(struct pipe_context *ctx,
 
       isl_buffer_fill_state(&screen->isl_dev, map,
                             .address = res->bo->gtt_offset + cbuf->data.offset,
-                            .size_B = input->buffer_size,
+                            .size_B = MIN2(input->buffer_size,
+                                           res->bo->size - cbuf->data.offset),
                             .format = ISL_FORMAT_R32G32B32A32_FLOAT,
                             .stride_B = 1,
                             .mocs = MOCS_WB)
@@ -2169,7 +2170,9 @@ iris_set_shader_buffers(struct pipe_context *ctx,
          isl_buffer_fill_state(&screen->isl_dev, map,
                                .address =
                                   res->bo->gtt_offset + buffer->buffer_offset,
-                               .size_B = buffer->buffer_size,
+                               .size_B =
+                                  MIN2(buffer->buffer_size,
+                                       res->bo->size - buffer->buffer_offset),
                                .format = ISL_FORMAT_RAW,
                                .stride_B = 1,
                                .mocs = MOCS_WB);