From 762a803aa7ba55e06254b5e0c80ffe26f1ec0381 Mon Sep 17 00:00:00 2001 From: Rhys Perry Date: Thu, 25 Sep 2025 13:28:59 +0100 Subject: [PATCH] radv: remove NIR_PASS in radv_nir_lower_rt_abi MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When NIR_DEBUG=serialize or NIR_DEBUG=clone is used, NIR_PASS recreates nir_function_impl and nir_variable objects, causing use-after-free since radv_nir_lower_rt_abi() keeps pointers to those in local variables. Signed-off-by: Rhys Perry Reviewed-by: Marek Olšák Reviewed-by: Georg Lehmann Part-of: --- src/amd/vulkan/nir/radv_nir_rt_shader.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/amd/vulkan/nir/radv_nir_rt_shader.c b/src/amd/vulkan/nir/radv_nir_rt_shader.c index 807fb679d88..888549ddf5f 100644 --- a/src/amd/vulkan/nir/radv_nir_rt_shader.c +++ b/src/amd/vulkan/nir/radv_nir_rt_shader.c @@ -1992,7 +1992,8 @@ radv_nir_lower_rt_abi(nir_shader *shader, const VkRayTracingPipelineCreateInfoKH } shader->scratch_size = 0; - NIR_PASS(_, shader, nir_lower_returns); + /* This can't use NIR_PASS because NIR_DEBUG=serialize,clone invalidates pointers. */ + nir_lower_returns(shader); nir_cf_list list; nir_cf_extract(&list, nir_before_impl(impl), nir_after_impl(impl));