[Mesa-dev] [PATCH] i965: Check if unsynchronized map fails in BufferSubData.

[Tapani Pälli]

Reviewed-by: Tapani Pälli <tapani.palli at intel.com>

On 09/12/2014 09:43 AM, Kenneth Graunke wrote:
> This patch fixes a NULL pointer dereference in a test case which
> allocates piles of buffers without ever freeing them, and repeatedly
> tries to upload/fetch data to/from those buffers, without doing any
> other work (such as rendering).
>
> The same problem exists in a variety of other places, some of which are
> more difficult to recover from.  This patch does not try to fix any of
> those.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82683
> Signed-off-by: Kenneth Graunke <kenneth at whitecape.org>
> ---
>  src/mesa/drivers/dri/i965/intel_buffer_objects.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/src/mesa/drivers/dri/i965/intel_buffer_objects.c b/src/mesa/drivers/dri/i965/intel_buffer_objects.c
> index 96dacde..d063d92 100644
> --- a/src/mesa/drivers/dri/i965/intel_buffer_objects.c
> +++ b/src/mesa/drivers/dri/i965/intel_buffer_objects.c
> @@ -252,7 +252,10 @@ intel_bufferobj_subdata(struct gl_context * ctx,
>     if (brw->has_llc) {
>        if (offset + size <= intel_obj->gpu_active_start ||
>            intel_obj->gpu_active_end <= offset) {
> -         drm_intel_gem_bo_map_unsynchronized(intel_obj->buffer);
> +         if (drm_intel_gem_bo_map_unsynchronized(intel_obj->buffer) < 0) {
> +            _mesa_error(ctx, GL_OUT_OF_MEMORY, "glBufferSubData (map failed)");
> +            return;
> +         }
>           memcpy(intel_obj->buffer->virtual + offset, data, size);
>           drm_intel_bo_unmap(intel_obj->buffer);
>