Mesa (main): panfrost: Don't crash on panfrost_bo_create() with size==0 invocation

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: 61f94fff0d594b3eddccc0ae2f3674aa0ef2cf97
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=61f94fff0d594b3eddccc0ae2f3674aa0ef2cf97

Author: Roman Stratiienko <r.stratiienko at gmail.com>
Date:   Mon Apr  4 20:52:59 2022 +0300

panfrost: Don't crash on panfrost_bo_create() with size==0 invocation

1. Clamp bucket_index from both ends to avoid returning negative index.
2. Return NULL in case BO allocation/fetching failure to prevent invalid
   bo mapping.

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6247
Signed-off-by: Roman Stratiienko <r.stratiienko at gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/15748>

---

 src/panfrost/lib/pan_bo.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/src/panfrost/lib/pan_bo.c b/src/panfrost/lib/pan_bo.c
index 1fb02514fca..93db292acd9 100644
--- a/src/panfrost/lib/pan_bo.c
+++ b/src/panfrost/lib/pan_bo.c
@@ -165,13 +165,8 @@ pan_bucket_index(unsigned size)
         /* Clamp the bucket index; all huge allocations will be
          * sorted into the largest bucket */
 
-        bucket_index = MIN2(bucket_index, MAX_BO_CACHE_BUCKET);
-
-        /* The minimum bucket size must equal the minimum allocation
-         * size; the maximum we clamped */
-
-        assert(bucket_index >= MIN_BO_CACHE_BUCKET);
-        assert(bucket_index <= MAX_BO_CACHE_BUCKET);
+        bucket_index = CLAMP(bucket_index, MIN_BO_CACHE_BUCKET,
+                             MAX_BO_CACHE_BUCKET);
 
         /* Reindex from 0 */
         return (bucket_index - MIN_BO_CACHE_BUCKET);
@@ -397,11 +392,13 @@ panfrost_bo_create(struct panfrost_device *dev, size_t size,
         if (!bo)
                 bo = panfrost_bo_cache_fetch(dev, size, flags, label, false);
 
-        if (!bo)
-                fprintf(stderr, "BO creation failed\n");
-
         assert(bo);
 
+        if (!bo) {
+                fprintf(stderr, "BO creation failed\n");
+                return NULL;
+        }
+
         /* Only mmap now if we know we need to. For CPU-invisible buffers, we
          * never map since we don't care about their contents; they're purely
          * for GPU-internal use. But we do trace them anyway. */