Mesa (main): panfrost: Emit the correct number of attributes

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: 379ae6d82383e0c70797d96de4e6966c972618fc
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=379ae6d82383e0c70797d96de4e6966c972618fc

Author: Icecream95 <ixn at disroot.org>
Date:   Sun Jul 10 20:52:54 2022 +1200

panfrost: Emit the correct number of attributes

create_vertex_elements_state is sometimes called with a too large
num_elements argument, for example with util_blitter, which causes a
buffer overflow.

There is no documentation to forbid this practice, so don't rely on
so->num_elements being correct and instead use the vertex shader
attribute count, which matches the value used to allocate the
descriptors.

Use attributes_read_count rather than attribute_count because the
latter also includes images and PAN_VERTEX_ID/PAN_INSTANCE_ID.

Fixes: 76de3e691c6 ("panfrost: Merge attribute packing routines")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/17447>

---

 src/gallium/drivers/panfrost/pan_cmdstream.c | 7 ++++++-
 src/panfrost/lib/pan_shader.c                | 3 ++-
 src/panfrost/util/pan_ir.h                   | 1 +
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/gallium/drivers/panfrost/pan_cmdstream.c b/src/gallium/drivers/panfrost/pan_cmdstream.c
index 4dd8fcba190..258abc1b375 100644
--- a/src/gallium/drivers/panfrost/pan_cmdstream.c
+++ b/src/gallium/drivers/panfrost/pan_cmdstream.c
@@ -2186,7 +2186,12 @@ panfrost_emit_vertex_data(struct panfrost_batch *batch,
          * addressing modes and now base is 64 aligned.
          */
 
-        for (unsigned i = 0; i < so->num_elements; ++i) {
+        /* While these are usually equal, they are not required to be. In some
+         * cases, u_blitter passes too high a value for num_elements.
+         */
+        assert(vs->info.attributes_read_count <= so->num_elements);
+
+        for (unsigned i = 0; i < vs->info.attributes_read_count; ++i) {
                 unsigned vbi = so->pipe[i].vertex_buffer_index;
                 struct pipe_vertex_buffer *buf = &ctx->vertex_buffers[vbi];
 
diff --git a/src/panfrost/lib/pan_shader.c b/src/panfrost/lib/pan_shader.c
index 12b25480be5..e5e95508d95 100644
--- a/src/panfrost/lib/pan_shader.c
+++ b/src/panfrost/lib/pan_shader.c
@@ -215,8 +215,9 @@ GENX(pan_shader_compile)(nir_shader *s,
 
         switch (info->stage) {
         case MESA_SHADER_VERTEX:
-                info->attribute_count = util_bitcount64(s->info.inputs_read);
                 info->attributes_read = s->info.inputs_read;
+                info->attributes_read_count = util_bitcount64(info->attributes_read);
+                info->attribute_count = info->attributes_read_count;
 
 #if PAN_ARCH <= 5
                 bool vertex_id = BITSET_TEST(s->info.system_values_read,
diff --git a/src/panfrost/util/pan_ir.h b/src/panfrost/util/pan_ir.h
index 820a6e61455..e3fb48e16d4 100644
--- a/src/panfrost/util/pan_ir.h
+++ b/src/panfrost/util/pan_ir.h
@@ -354,6 +354,7 @@ struct pan_shader_info {
         unsigned sampler_count;
         unsigned texture_count;
         unsigned ubo_count;
+        unsigned attributes_read_count;
         unsigned attribute_count;
         unsigned attributes_read;