[Mesa-dev] [PATCH 3/3] radeonsi: fix up buffer descriptor upper-bound checking

[Nicolai Hähnle]

Patch 1 & 2, where I only looked at the st/mesa and radeon parts:

Acked-by: Nicolai Hähnle <nicolai.haehnle at amd.com>

Patch 3:

Reviewed-by: Nicolai Hähnle <nicolai.haehnle at amd.com>

On 12.08.2016 18:46, Marek Olšák wrote:
> From: Marek Olšák <marek.olsak at amd.com>
>
> st/mesa does this too, so we're safe.
> ---
>  src/gallium/drivers/radeonsi/si_state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/gallium/drivers/radeonsi/si_state.c b/src/gallium/drivers/radeonsi/si_state.c
> index 7e63d48..25dfe26 100644
> --- a/src/gallium/drivers/radeonsi/si_state.c
> +++ b/src/gallium/drivers/radeonsi/si_state.c
> @@ -2655,21 +2655,21 @@ si_make_buffer_descriptor(struct si_screen *screen, struct r600_resource *buf,
>  	unsigned num_format, data_format;
>
>  	desc = util_format_description(format);
>  	first_non_void = util_format_get_first_non_void_channel(format);
>  	stride = desc->block.bits / 8;
>  	va = buf->gpu_address + offset;
>  	num_format = si_translate_buffer_numformat(&screen->b.b, desc, first_non_void);
>  	data_format = si_translate_buffer_dataformat(&screen->b.b, desc, first_non_void);
>
>  	num_records = size / stride;
> -	num_records = MIN2(num_records, buf->b.b.width0 / stride);
> +	num_records = MIN2(num_records, (buf->b.b.width0 - offset) / stride);
>
>  	if (screen->b.chip_class >= VI)
>  		num_records *= stride;
>
>  	state[4] = va;
>  	state[5] = S_008F04_BASE_ADDRESS_HI(va >> 32) |
>  		   S_008F04_STRIDE(stride);
>  	state[6] = num_records;
>  	state[7] = S_008F0C_DST_SEL_X(si_map_swizzle(desc->swizzle[0])) |
>  		   S_008F0C_DST_SEL_Y(si_map_swizzle(desc->swizzle[1])) |
>