From ff68e05bc3f8c98ccfc26b03ec68b183af9172f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Brooke?= <aurelien@bahiasoft.fr>
Date: Thu, 23 Jan 2025 14:44:50 +0100
Subject: [PATCH] rhi: vulkan: fix the pWaitDstStageMask parameter of
 vkQueueSubmit

It expects one mask per wait semaphore, where only one was given,
leading to an out-of-bound read.

Amends 202dd3cb39ab4408c44a8588b8d6fb9a1cc3a184.

Fixes: QTBUG-132356
Pick-to: 6.9
Change-Id: I6f7d33eb4568d1577e09411f7be751c8dc520429
Reviewed-by: Laszlo Agocs <laszlo.agocs@qt.io>
---
 src/gui/rhi/qrhivulkan.cpp | 9 ++++-----
 src/gui/rhi/qrhivulkan_p.h | 1 +
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/gui/rhi/qrhivulkan.cpp b/src/gui/rhi/qrhivulkan.cpp
index dbef24848ea..7ff3f335d82 100644
--- a/src/gui/rhi/qrhivulkan.cpp
+++ b/src/gui/rhi/qrhivulkan.cpp
@@ -2847,18 +2847,17 @@ QRhi::FrameOpResult QRhiVulkan::endAndSubmitPrimaryCommandBuffer(VkCommandBuffer
     if (signalSem)
         signalSemaphoresForQueueSubmit.append(*signalSem);
 
+    submitInfo.waitSemaphoreCount = uint32_t(waitSemaphoresForQueueSubmit.count());
     if (!waitSemaphoresForQueueSubmit.isEmpty()) {
-        submitInfo.waitSemaphoreCount = uint32_t(waitSemaphoresForQueueSubmit.count());
         submitInfo.pWaitSemaphores = waitSemaphoresForQueueSubmit.constData();
+        semaphoresWaitMasksForQueueSubmit.resize(waitSemaphoresForQueueSubmit.count(), VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT);
+        submitInfo.pWaitDstStageMask = semaphoresWaitMasksForQueueSubmit.constData();
     }
+    submitInfo.signalSemaphoreCount = uint32_t(signalSemaphoresForQueueSubmit.count());
     if (!signalSemaphoresForQueueSubmit.isEmpty()) {
-        submitInfo.signalSemaphoreCount = uint32_t(signalSemaphoresForQueueSubmit.count());
         submitInfo.pSignalSemaphores = signalSemaphoresForQueueSubmit.constData();
     }
 
-    VkPipelineStageFlags psf = VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT;
-    submitInfo.pWaitDstStageMask = &psf;
-
     err = df->vkQueueSubmit(gfxQueue, 1, &submitInfo, cmdFence);
 
     waitSemaphoresForQueueSubmit.clear();
diff --git a/src/gui/rhi/qrhivulkan_p.h b/src/gui/rhi/qrhivulkan_p.h
index cdd2b42ea34..13bcf741fbf 100644
--- a/src/gui/rhi/qrhivulkan_p.h
+++ b/src/gui/rhi/qrhivulkan_p.h
@@ -1089,6 +1089,7 @@ public:
 #endif
 
     QVarLengthArray<VkSemaphore, 4> waitSemaphoresForQueueSubmit;
+    QVarLengthArray<VkPipelineStageFlags, 4> semaphoresWaitMasksForQueueSubmit;
     QVarLengthArray<VkSemaphore, 4> signalSemaphoresForQueueSubmit;
     QVarLengthArray<VkSemaphore, 4> waitSemaphoresForPresent;
 };