From 0921dfa04476c8c93e3caa7587905edf1b623749 Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Tue, 20 Aug 2024 16:43:59 -0700 Subject: [PATCH] anv: Protect against OOB access to anv_state_pool::buckets Suggested-by: Paulo Zanoni Reviewed-by: Paulo Zanoni Cc: mesa-stable Part-of: --- src/intel/vulkan/anv_allocator.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/intel/vulkan/anv_allocator.c b/src/intel/vulkan/anv_allocator.c index 7ea37ebe4df..277ba3b40a3 100644 --- a/src/intel/vulkan/anv_allocator.c +++ b/src/intel/vulkan/anv_allocator.c @@ -777,6 +777,10 @@ anv_state_pool_return_blocks(struct anv_state_pool *pool, } uint32_t block_bucket = anv_state_pool_get_bucket(block_size); + + if (block_bucket >= ARRAY_SIZE(pool->buckets)) + return; + anv_free_list_push(&pool->buckets[block_bucket].free_list, &pool->table, st_idx, count); } @@ -839,6 +843,9 @@ anv_state_pool_alloc_no_vg(struct anv_state_pool *pool, { uint32_t bucket = anv_state_pool_get_bucket(MAX2(size, align)); + if (bucket >= ARRAY_SIZE(pool->buckets)) + return ANV_STATE_NULL; + struct anv_state *state; uint32_t alloc_size = anv_state_pool_get_bucket_size(bucket); int64_t offset; @@ -949,6 +956,9 @@ anv_state_pool_free_no_vg(struct anv_state_pool *pool, struct anv_state state) assert(state.offset >= pool->start_offset); + if (bucket >= ARRAY_SIZE(pool->buckets)) + return; + anv_free_list_push(&pool->buckets[bucket].free_list, &pool->table, state.idx, 1); }