Mesa (staging/21.3): panvk: Fix pointer corruption in panvk_add_wait_event_syncobjs

[GitLab Mirror]

Module: Mesa
Branch: staging/21.3
Commit: 3bad11501c380fab2a90055de8f65d66a6ab19c6
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=3bad11501c380fab2a90055de8f65d66a6ab19c6

Author: Manas Chaudhary <manas.chaudhary at collabora.com>
Date:   Thu Jan 27 02:44:41 2022 +0530

panvk: Fix pointer corruption in panvk_add_wait_event_syncobjs

nr_in_fences was being incremented to point to an
illegal address

Fixes: 1e23004600c3 ("panvk: Add vkEvents support")
Cc: mesa-stable
Signed-off-by: Manas Chaudhary <manas.chaudhary at collabora.com>
Reviewed-by: Boris Brezillon <boris.brezillon at collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/14744>
(cherry picked from commit cad053db6152ee01950af8d7418c7672fd8abfe7)

---

 .pick_status.json                     | 2 +-
 src/panfrost/vulkan/panvk_vX_device.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index f6f6b575baf..a51047c8867 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -85,7 +85,7 @@
         "description": "panvk: Fix pointer corruption in panvk_add_wait_event_syncobjs",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "1e23004600c3b29776c2a36854b1a1c8756d5f81"
     },
diff --git a/src/panfrost/vulkan/panvk_vX_device.c b/src/panfrost/vulkan/panvk_vX_device.c
index 32c816cfb83..78d968c0e4d 100644
--- a/src/panfrost/vulkan/panvk_vX_device.c
+++ b/src/panfrost/vulkan/panvk_vX_device.c
@@ -157,7 +157,7 @@ panvk_add_wait_event_syncobjs(struct panvk_batch *batch, uint32_t *in_fences, un
          /* Nothing to do yet */
          break;
       case PANVK_EVENT_OP_WAIT:
-         in_fences[*nr_in_fences++] = op->event->syncobj;
+         in_fences[(*nr_in_fences)++] = op->event->syncobj;
          break;
       default:
          unreachable("bad panvk_event_op type\n");