From f4204ba53d8406415ba369a476e00c03428a43f2 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Nicolai=20H=C3=A4hnle?= Date: Mon, 8 Aug 2016 23:52:54 +0200 Subject: [PATCH] gallium/radeon: protect against out of bounds temporary array accesses MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit They can lead to VM faults and worse, which goes against the GL robustness promises. Reviewed-by: Marek Olšák --- .../drivers/radeon/radeon_setup_tgsi_llvm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c index 7cdf2287d47..88c7b3c1d18 100644 --- a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c +++ b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c @@ -239,6 +239,21 @@ get_pointer_into_array(struct radeon_llvm_context *ctx, index = emit_array_index(&ctx->soa, reg_indirect, reg_index - ctx->temp_arrays[array_id - 1].range.First); + + /* Ensure that the index is within a valid range, to guard against + * VM faults and overwriting critical data (e.g. spilled resource + * descriptors). + * + * TODO It should be possible to avoid the additional instructions + * if LLVM is changed so that it guarantuees: + * 1. the scratch space descriptor isolates the current wave (this + * could even save the scratch offset SGPR at the cost of an + * additional SALU instruction) + * 2. the memory for allocas must be allocated at the _end_ of the + * scratch space (after spilled registers) + */ + index = radeon_llvm_bound_index(ctx, index, array->range.Last - array->range.First + 1); + index = LLVMBuildMul( builder, index, lp_build_const_int32(gallivm, util_bitcount(array->writemask)), -- 2.30.2