Mesa (master): intel/compiler: Handle invalid compacted immediates

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: 40f0ade68ea870c4e97a30711e62e4ec69a888b6
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=40f0ade68ea870c4e97a30711e62e4ec69a888b6

Author: Matt Turner <mattst88 at gmail.com>
Date:   Wed Nov  6 10:05:48 2019 -0800

intel/compiler: Handle invalid compacted immediates

16-bit immediates need to be replicated through the 32-bit immediate
field, so we should never see one that isn't.

This does happen however in the fuzzer unit test, so returning false
allows the fuzzer to reject this case.

Reviewed-by: Caio Marcelo de Oliveira Filho <caio.oliveira at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/2635>

---

 src/intel/compiler/brw_eu_compact.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/intel/compiler/brw_eu_compact.c b/src/intel/compiler/brw_eu_compact.c
index 7c42aeec3dd..45e158fb2a6 100644
--- a/src/intel/compiler/brw_eu_compact.c
+++ b/src/intel/compiler/brw_eu_compact.c
@@ -1413,6 +1413,20 @@ compact_immediate(const struct gen_device_info *devinfo,
                   enum brw_reg_type type, unsigned imm)
 {
    if (devinfo->gen >= 12) {
+      /* 16-bit immediates need to be replicated through the 32-bit immediate
+       * field
+       */
+      switch (type) {
+      case BRW_REGISTER_TYPE_W:
+      case BRW_REGISTER_TYPE_UW:
+      case BRW_REGISTER_TYPE_HF:
+         if ((imm >> 16) != (imm & 0xffff))
+            return -1;
+         break;
+      default:
+         break;
+      }
+
       switch (type) {
       case BRW_REGISTER_TYPE_F:
          /* We get the high 12-bits as-is; rest must be zero */
@@ -1453,7 +1467,7 @@ compact_immediate(const struct gen_device_info *devinfo,
       case BRW_REGISTER_TYPE_UQ:
       case BRW_REGISTER_TYPE_B:
       case BRW_REGISTER_TYPE_UB:
-         unreachable("not reached");
+         return -1;
       }
    } else {
       /* We get the low 12 bits as-is; 13th is replicated */