panfrost: Emit the correct number of attributes

create_vertex_elements_state is sometimes called with a too large
num_elements argument, for example with util_blitter, which causes a
buffer overflow.

There is no documentation to forbid this practice, so don't rely on
so->num_elements being correct and instead use the vertex shader
attribute count, which matches the value used to allocate the
descriptors.

Use attributes_read_count rather than attribute_count because the
latter also includes images and PAN_VERTEX_ID/PAN_INSTANCE_ID.

Fixes: 76de3e691c6 ("panfrost: Merge attribute packing routines")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/17447>

diff --git a/src/gallium/drivers/panfrost/pan_cmdstream.c b/src/gallium/drivers/panfrost/pan_cmdstream.c
index 4dd8fcb..258abc1 100644 (file)
--- a/src/gallium/drivers/panfrost/pan_cmdstream.c
+++ b/src/gallium/drivers/panfrost/pan_cmdstream.c
@@ -2186,7 +2186,12 @@ panfrost_emit_vertex_data(struct panfrost_batch *batch,
          * addressing modes and now base is 64 aligned.
          */
 
-        for (unsigned i = 0; i < so->num_elements; ++i) {
+        /* While these are usually equal, they are not required to be. In some
+         * cases, u_blitter passes too high a value for num_elements.
+         */
+        assert(vs->info.attributes_read_count <= so->num_elements);
+
+        for (unsigned i = 0; i < vs->info.attributes_read_count; ++i) {
                 unsigned vbi = so->pipe[i].vertex_buffer_index;
                 struct pipe_vertex_buffer *buf = &ctx->vertex_buffers[vbi];
 

diff --git a/src/panfrost/lib/pan_shader.c b/src/panfrost/lib/pan_shader.c
index 12b2548..e5e9550 100644 (file)
--- a/src/panfrost/lib/pan_shader.c
+++ b/src/panfrost/lib/pan_shader.c
@@ -215,8 +215,9 @@ GENX(pan_shader_compile)(nir_shader *s,
 
         switch (info->stage) {
         case MESA_SHADER_VERTEX:
-                info->attribute_count = util_bitcount64(s->info.inputs_read);
                 info->attributes_read = s->info.inputs_read;
+                info->attributes_read_count = util_bitcount64(info->attributes_read);
+                info->attribute_count = info->attributes_read_count;
 
 #if PAN_ARCH <= 5
                 bool vertex_id = BITSET_TEST(s->info.system_values_read,

diff --git a/src/panfrost/util/pan_ir.h b/src/panfrost/util/pan_ir.h
index 820a6e6..e3fb48e 100644 (file)
--- a/src/panfrost/util/pan_ir.h
+++ b/src/panfrost/util/pan_ir.h
@@ -354,6 +354,7 @@ struct pan_shader_info {
         unsigned sampler_count;
         unsigned texture_count;
         unsigned ubo_count;
+        unsigned attributes_read_count;
         unsigned attribute_count;
         unsigned attributes_read;