Mesa (main): panvk: Fix pointer corruption in panvk_add_wait_event_syncobjs

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: cad053db6152ee01950af8d7418c7672fd8abfe7
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=cad053db6152ee01950af8d7418c7672fd8abfe7

Author: Manas Chaudhary <manas.chaudhary at collabora.com>
Date:   Thu Jan 27 02:44:41 2022 +0530

panvk: Fix pointer corruption in panvk_add_wait_event_syncobjs

nr_in_fences was being incremented to point to an
illegal address

Fixes: 1e23004600c3 ("panvk: Add vkEvents support")
Cc: mesa-stable
Signed-off-by: Manas Chaudhary <manas.chaudhary at collabora.com>
Reviewed-by: Boris Brezillon <boris.brezillon at collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/14744>

---

 src/panfrost/vulkan/panvk_vX_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/panfrost/vulkan/panvk_vX_device.c b/src/panfrost/vulkan/panvk_vX_device.c
index 32c816cfb83..78d968c0e4d 100644
--- a/src/panfrost/vulkan/panvk_vX_device.c
+++ b/src/panfrost/vulkan/panvk_vX_device.c
@@ -157,7 +157,7 @@ panvk_add_wait_event_syncobjs(struct panvk_batch *batch, uint32_t *in_fences, un
          /* Nothing to do yet */
          break;
       case PANVK_EVENT_OP_WAIT:
-         in_fences[*nr_in_fences++] = op->event->syncobj;
+         in_fences[(*nr_in_fences)++] = op->event->syncobj;
          break;
       default:
          unreachable("bad panvk_event_op type\n");