From 8c94742935ef7394732ab37e6fc809de8efb3c79 Mon Sep 17 00:00:00 2001 From: Alyssa Rosenzweig Date: Sat, 26 Jun 2021 12:05:21 -0400 Subject: [PATCH] asahi: Guard for overflow when packing I'm not convinced this is right. Signed-off-by: Alyssa Rosenzweig Part-of: --- src/gallium/drivers/asahi/agx_state.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/gallium/drivers/asahi/agx_state.c b/src/gallium/drivers/asahi/agx_state.c index d4a13ec..1efd333 100644 --- a/src/gallium/drivers/asahi/agx_state.c +++ b/src/gallium/drivers/asahi/agx_state.c @@ -955,6 +955,7 @@ agx_build_pipeline(struct agx_context *ctx, struct agx_compiled_shader *cs, enum /* There is a maximum number of half words we may push with a single * BIND_UNIFORM record, so split up the range to fit. We only need to call * agx_push_location once, however, which reduces the cost. */ + unsigned unif_records = 0; for (unsigned i = 0; i < cs->info.push_ranges; ++i) { struct agx_push push = cs->info.push[i]; @@ -962,6 +963,10 @@ agx_build_pipeline(struct agx_context *ctx, struct agx_compiled_shader *cs, enum unsigned halfs_per_record = 14; unsigned records = DIV_ROUND_UP(push.length, halfs_per_record); + /* Ensure we don't overflow */ + unif_records += records; + assert(unif_records < 16); + for (unsigned j = 0; j < records; ++j) { agx_pack(record, BIND_UNIFORM, cfg) { cfg.start_halfs = push.base + (j * halfs_per_record); -- 2.7.4