<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Invalid read in intel_tiled_memcpy.c ytiled_to_linear"
href="https://bugs.freedesktop.org/show_bug.cgi?id=91065#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Invalid read in intel_tiled_memcpy.c ytiled_to_linear"
href="https://bugs.freedesktop.org/show_bug.cgi?id=91065">bug 91065</a>
from <span class="vcard"><a class="email" href="mailto:arcppzju+fdbug@gmail.com" title="Jun Wu <arcppzju+fdbug@gmail.com>"> <span class="fn">Jun Wu</span></a>
</span></b>
<pre>It seems the quick workaround is like:
--- a/src/mesa/drivers/dri/i965/intel_pixel_read.c
+++ b/src/mesa/drivers/dri/i965/intel_pixel_read.c
@@ -185,6 +185,14 @@ intel_readpixels_tiled_memcpy(struct gl_context * ctx,
dst_pitch = -dst_pitch;
}
+ /* For I915_TILING_Y, if src does not have enough pixels, decrease height
+ * silently to prevent invalid memory access.
+ */
+ uint32_t tiling = irb->mt->tiling;
+ if (tiling == I915_TILING_Y && bo->size < height * dst_pitch) {
+ height = bo->size / dst_pitch;
+ }
+
/* We postponed printing this message until having committed to executing
* the function.
*/
@@ -203,7 +211,7 @@ intel_readpixels_tiled_memcpy(struct gl_context * ctx,
bo->virtual,
dst_pitch, irb->mt->pitch,
brw->has_swizzling,
- irb->mt->tiling,
+ tiling,
mem_copy
);
However I am not sure about whether it is a correct fix or not.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>