From 44b4fee786189d1f44761a03d7d350911abacc45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= Date: Wed, 31 Jan 2024 06:03:24 -0800 Subject: [PATCH] iris: Avoid read of uninitialized value in blorp_clear_stencil_as_rgba() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In clear_depth_stencil() stencil_surf is defined but not initiaized. Then in the same function if stencil_mask is calculated and if != 0 stencil_surf is initialized. But blorp_clear_stencil_as_rgba() access stencil_surf before checking stencil_mask, what could cause a read of a uninitialized valued. clear_depth_stencil() struct blorp_surf stencil_surf; ... uint8_t stencil_mask = clear_stencil && stencil_res ? 0xff : 0; if (stencil_mask) { ... iris_blorp_surf_for_resource(&stencil_surf); } ... blorp_clear_depth_stencil(stencil_mask, stencil_surf) blorp_clear_stencil_as_rgba(stencil_mask, stencil) if (surf->surf->format ...) .... Just inverting the order and checking stencil_mask first in blorp_clear_stencil_as_rgba() fixes the issue. Signed-off-by: José Roberto de Souza Reviewed-by: Dylan Baker Part-of: --- src/intel/blorp/blorp_clear.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/intel/blorp/blorp_clear.c b/src/intel/blorp/blorp_clear.c index 19d3949a4d9..82c334af653 100644 --- a/src/intel/blorp/blorp_clear.c +++ b/src/intel/blorp/blorp_clear.c @@ -755,15 +755,15 @@ blorp_clear_stencil_as_rgba(struct blorp_batch *batch, { assert((batch->flags & BLORP_BATCH_USE_COMPUTE) == 0); + /* Stencil mask support would require piles of shader magic */ + if (stencil_mask != 0xff) + return false; + /* We only support separate W-tiled stencil for now */ if (surf->surf->format != ISL_FORMAT_R8_UINT || surf->surf->tiling != ISL_TILING_W) return false; - /* Stencil mask support would require piles of shader magic */ - if (stencil_mask != 0xff) - return false; - if (surf->surf->samples > 1) { /* Adjust x0, y0, x1, and y1 to be in units of samples */ assert(surf->surf->msaa_layout == ISL_MSAA_LAYOUT_INTERLEAVED);