From 4f17852474299a71f173ac1ce4769db83971945a Mon Sep 17 00:00:00 2001 From: Alyssa Rosenzweig Date: Fri, 19 Feb 2021 09:45:30 -0500 Subject: [PATCH] panfrost: Fix NULL deref in pan_mfbd.c Auditing all uses of nr_cbufs Signed-off-by: Alyssa Rosenzweig Reviewed-by: Boris Brezillon Part-of: --- src/gallium/drivers/panfrost/pan_mfbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/gallium/drivers/panfrost/pan_mfbd.c b/src/gallium/drivers/panfrost/pan_mfbd.c index 11a15c6af66..b7cf4919ac0 100644 --- a/src/gallium/drivers/panfrost/pan_mfbd.c +++ b/src/gallium/drivers/panfrost/pan_mfbd.c @@ -35,9 +35,8 @@ panfrost_mfbd_has_zs_crc_ext(struct panfrost_batch *batch) { if (batch->key.nr_cbufs == 1) { struct pipe_surface *surf = batch->key.cbufs[0]; - struct panfrost_resource *rsrc = pan_resource(surf->texture); - if (rsrc->checksummed) + if (surf->texture && pan_resource(surf->texture)->checksummed) return true; } @@ -260,7 +259,7 @@ panfrost_mfbd_zs_crc_ext_set_bufs(struct panfrost_batch *batch, struct panfrost_device *dev = pan_device(batch->ctx->base.screen); /* Checksumming only works with a single render target */ - if (batch->key.nr_cbufs == 1) { + if (batch->key.nr_cbufs == 1 && batch->key.cbufs[0]) { struct pipe_surface *c_surf = batch->key.cbufs[0]; struct panfrost_resource *rsrc = pan_resource(c_surf->texture); @@ -434,7 +433,9 @@ pan_internal_cbuf_size(struct panfrost_batch *batch, unsigned *tile_size) *tile_size = 16 * 16; for (int cb = 0; cb < batch->key.nr_cbufs; ++cb) { struct pipe_surface *surf = batch->key.cbufs[cb]; - assert(surf); + + if (!surf) + continue; unsigned nr_samples = MAX3(surf->nr_samples, surf->texture->nr_samples, 1); total_size += pan_bytes_per_pixel_tib(surf->format) *