Skip to content

anv: fix freed memory access on push constant layout

Push constant layout is allocated off the stage_ctx currently, but it's used much later when the anv_shader_bin is created. So we probably want to allocate everything off the pipeline_ctx, it's going to be free at the end of pipeline creation anyway.

==174623== Invalid read of size 8
==174623==    at 0x483F846: memmove (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==174623==    by 0xC012815: anv_shader_bin_create (anv_pipeline_cache.c:102)
==174623==    by 0xC013682: anv_pipeline_cache_add_shader_locked (anv_pipeline_cache.c:432)
==174623==    by 0xC013726: anv_pipeline_cache_upload_kernel (anv_pipeline_cache.c:461)
==174623==    by 0xC014006: anv_device_upload_kernel (anv_pipeline_cache.c:720)
==174623==    by 0xC00DFF3: anv_pipeline_compile_graphics (anv_pipeline.c:1676)
==174623==    by 0xC00FDE9: anv_graphics_pipeline_init (anv_pipeline.c:2313)
==174623==    by 0xCAA3A32: gfx125_graphics_pipeline_create (genX_pipeline.c:2534)
==174623==    by 0xCAA50C4: gfx125_CreateGraphicsPipelines (genX_pipeline.c:2846)
==174623==    by 0xBA254B3: vkCreateGraphicsPipelines (trampoline.c:1309)
==174623==    by 0x67F28E9: WrappedVulkan::vkCreateGraphicsPipelines(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) (vk_shader_funcs.cpp:513)
==174623==    by 0x6194FBA: create(WrappedVulkan*, char const*, int, VkPipeline_T**, ConciseGraphicsPipeline const&) (vk_debug.cpp:349)
==174623==  Address 0x4fba310 is 48 bytes inside a block of size 64 free'd
==174623==    at 0x48399AB: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==174623==    by 0xCC61F16: unsafe_free (ralloc.c:315)
==174623==    by 0xCC61EDB: unsafe_free (ralloc.c:308)
==174623==    by 0xCC61DFC: ralloc_free (ralloc.c:278)
==174623==    by 0xC00DBB6: anv_pipeline_compile_graphics (anv_pipeline.c:1620)
==174623==    by 0xC00FDE9: anv_graphics_pipeline_init (anv_pipeline.c:2313)
==174623==    by 0xCAA3A32: gfx125_graphics_pipeline_create (genX_pipeline.c:2534)
==174623==    by 0xCAA50C4: gfx125_CreateGraphicsPipelines (genX_pipeline.c:2846)
==174623==    by 0xBA254B3: vkCreateGraphicsPipelines (trampoline.c:1309)
==174623==    by 0x67F28E9: WrappedVulkan::vkCreateGraphicsPipelines(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) (vk_shader_funcs.cpp:513)
==174623==    by 0x6194FBA: create(WrappedVulkan*, char const*, int, VkPipeline_T**, ConciseGraphicsPipeline const&) (vk_debug.cpp:349)
==174623==    by 0x6198612: VulkanDebugManager::VulkanDebugManager(WrappedVulkan*) (vk_debug.cpp:657)
==174623==  Block was alloc'd at
==174623==    at 0x483877F: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==174623==    by 0xCC6192B: ralloc_size (ralloc.c:133)
==174623==    by 0xCC619F5: rzalloc_size (ralloc.c:166)
==174623==    by 0xCC61D01: rzalloc_array_size (ralloc.c:246)
==174623==    by 0xBFFAFAA: anv_nir_compute_push_layout (anv_nir_compute_push_layout.c:119)
==174623==    by 0xC00B0C8: anv_pipeline_lower_nir (anv_pipeline.c:827)
==174623==    by 0xC00DA49: anv_pipeline_compile_graphics (anv_pipeline.c:1609)
==174623==    by 0xC00FDE9: anv_graphics_pipeline_init (anv_pipeline.c:2313)
==174623==    by 0xCAA3A32: gfx125_graphics_pipeline_create (genX_pipeline.c:2534)
==174623==    by 0xCAA50C4: gfx125_CreateGraphicsPipelines (genX_pipeline.c:2846)
==174623==    by 0xBA254B3: vkCreateGraphicsPipelines (trampoline.c:1309)
==174623==    by 0x67F28E9: WrappedVulkan::vkCreateGraphicsPipelines(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**) (vk_shader_funcs.cpp:513)

Signed-off-by: Lionel Landwerlin lionel.g.landwerlin@intel.com Cc: mesa-stable

Edited by Lionel Landwerlin

Merge request reports