Unmap the host buffer only after done accessing it

Most likely 64c479e9da02f724e1870649c99fac92f5f27cd3 accidentally made the
code unmap the host buffer before it is accessed, but the code continued to
work by accident in many (most?) cases. Either because in the case of OpenCL
devices that share memory with the CPU, the host buffer *is* the OpenCL
buffer, so even if the host buffer is "unmapped", it still exists. In the
case of GPU device with separate memory, using the host buffer after unmapping
corresponds simply to a case of use after free of a heap-allocated buffer,
which often happens to work.

Found by code reading.

Change-Id: I9e2b4574077a267938702c0f81c4b1cba9c9a183

1 files changed, 14 insertions, 7 deletions

diff --git a/sc/source/core/opencl/formulagroupcl.cxx b/sc/source/core/opencl/formulagroupcl.cxx
index 381fb1d75720..d50814149427 100644
--- a/sc/source/core/opencl/formulagroupcl.cxx
+++ b/sc/source/core/opencl/formulagroupcl.cxx
@@ -3965,13 +3965,6 @@ public:
             mpResBuf = NULL;
             return;
         }
-
-        err = clEnqueueUnmapMemObject(kEnv.mpkCmdQueue, mpCLResBuf, mpResBuf, 0, NULL, NULL);
-        if (err != CL_SUCCESS)
-        {
-            SAL_WARN("sc.opencl", "clEnqueueUnmapMemObject failed: " << ::opencl::errorString(err));
-            mpResBuf = NULL;
-        }
     }
 
     bool pushResultToDocument( ScDocument& rDoc, const ScAddress& rTopPos )
@@ -3980,6 +3973,20 @@ public:
             return false;
 
         rDoc.SetFormulaResults(rTopPos, mpResBuf, mnGroupLength);
+
+        // Obtain cl context
+        ::opencl::KernelEnv kEnv;
+        ::opencl::setKernelEnv(&kEnv);
+
+        cl_int err;
+        err = clEnqueueUnmapMemObject(kEnv.mpkCmdQueue, mpCLResBuf, mpResBuf, 0, NULL, NULL);
+
+        if (err != CL_SUCCESS)
+        {
+            SAL_WARN("sc.opencl", "clEnqueueUnmapMemObject failed: " << ::opencl::errorString(err));
+            return false;
+        }
+
         return true;
     }
 };