[Mesa-dev] [PATCH] radv/xfb: fix counter buffer bounds checks.

[Samuel Pitoiset]

Reviewed-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>

On 12/13/18 4:32 AM, Dave Airlie wrote:
> From: Dave Airlie <airlied at redhat.com>
> 
> If we gave this function 0 counter buffers, we'd still try and
> access pCounterBuffers[0] as this check was incorrect.
> 
> Fixes crash with ext_transform_feedback-pipeline-basic-primgen
> on zink on radv.
> 
> Fixes: 677b496b6 (radv: fix begin/end transform feedback with 0 counter buffers.)
> Signed-off-by: Dave Airlie <airlied at redhat.com>
> ---
>   src/amd/vulkan/radv_cmd_buffer.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/amd/vulkan/radv_cmd_buffer.c b/src/amd/vulkan/radv_cmd_buffer.c
> index 23909a0f7dd..e08d37ee1f2 100644
> --- a/src/amd/vulkan/radv_cmd_buffer.c
> +++ b/src/amd/vulkan/radv_cmd_buffer.c
> @@ -4830,7 +4830,7 @@ void radv_CmdBeginTransformFeedbackEXT(
>   	assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
>   	for_each_bit(i, so->enabled_mask) {
>   		int32_t counter_buffer_idx = i - firstCounterBuffer;
> -		if (counter_buffer_idx >= 0 && counter_buffer_idx > counterBufferCount)
> +		if (counter_buffer_idx >= 0 && counter_buffer_idx >= counterBufferCount)
>   			counter_buffer_idx = -1;
>   
>   		/* SI binds streamout buffers as shader resources.
> @@ -4892,7 +4892,7 @@ void radv_CmdEndTransformFeedbackEXT(
>   	assert(firstCounterBuffer + counterBufferCount <= MAX_SO_BUFFERS);
>   	for_each_bit(i, so->enabled_mask) {
>   		int32_t counter_buffer_idx = i - firstCounterBuffer;
> -		if (counter_buffer_idx >= 0 && counter_buffer_idx > counterBufferCount)
> +		if (counter_buffer_idx >= 0 && counter_buffer_idx >= counterBufferCount)
>   			counter_buffer_idx = -1;
>   
>   		if (counter_buffer_idx >= 0 && pCounterBuffers && pCounterBuffers[counter_buffer_idx]) {
>