From 88cfa8ff29103ae2b1cd43b912cd6218d95c2cb2 Mon Sep 17 00:00:00 2001 From: utzcoz Date: Mon, 30 Mar 2026 00:39:55 +0800 Subject: [PATCH] gfxstream: Fix vkSetDebugUtilsObjectNameEXT crash for unwrapped objects Mesa's vk_common_SetDebugUtilsObjectNameEXT assumes every Vulkan object handle is a pointer to a vk_object_base struct. In gfxstream, only a subset of objects (instance, device, queue, command buffer, command pool, buffer, fence, semaphore) carry a Mesa wrapper. All other non-dispatchable handles (shader modules, pipelines, render passes, etc.) are opaque host handles that are not valid pointers. Passing such an unwrapped handle to the common path causes it to be cast to a vk_object_base pointer and dereferenced, resulting in a SIGSEGV (null-pointer dereference at offset 0x40). Override the function in the gfxstream driver to store debug names on vk_object_base for wrapped objects and return VK_SUCCESS for unwrapped objects. Fixes: 7b50e62179f2 ("gfxstream: mega-change to support guest Linux WSI with gfxstream") Test: Verified with hellovk (with validation layers) on Android Emulator - no crashes. (cherry picked from commit bf8862b49f18269ff41d88deab826bc5cea3141a) Part-of: --- .pick_status.json | 2 +- .../guest/vulkan/gfxstream_vk_device.cpp | 38 +++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/.pick_status.json b/.pick_status.json index 98a7870cb83..afaf15eb440 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -604,7 +604,7 @@ "description": "gfxstream: Fix vkSetDebugUtilsObjectNameEXT crash for unwrapped objects", "nominated": true, "nomination_type": 2, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "7b50e62179f201279d75700f8c53ad4d28fd4b32", "notes": null diff --git a/src/gfxstream/guest/vulkan/gfxstream_vk_device.cpp b/src/gfxstream/guest/vulkan/gfxstream_vk_device.cpp index 95824d074c9..c979d699f62 100644 --- a/src/gfxstream/guest/vulkan/gfxstream_vk_device.cpp +++ b/src/gfxstream/guest/vulkan/gfxstream_vk_device.cpp @@ -15,6 +15,7 @@ #include "gfxstream_vk_private.h" #include "util/detect_os.h" #include "util/perf/cpu_trace.h" +#include "vk_common_entrypoints.h" #include "vk_sync_dummy.h" #include "vk_util.h" @@ -821,3 +822,40 @@ void gfxstream_vk_UpdateDescriptorSets(VkDevice device, uint32_t descriptorWrite internal_pDescriptorWrites.data(), descriptorCopyCount, pDescriptorCopies); } } + +/* + * Override vk_common_SetDebugUtilsObjectNameEXT. + * + * Mesa's common implementation assumes every Vulkan object handle is a pointer + * to a vk_object_base. In gfxstream, only a subset of objects carry a Mesa + * wrapper; all other non-dispatchable handles are opaque host handles. Passing + * such a handle to the common path causes a null-pointer dereference. + * + * For wrapped objects we delegate to the common implementation. For unwrapped + * objects we return VK_SUCCESS as a no-op; the names would only become useful + * once guest-to-host forwarding is implemented. + */ +VkResult gfxstream_vk_SetDebugUtilsObjectNameEXT(VkDevice device, + const VkDebugUtilsObjectNameInfoEXT* pNameInfo) { + MESA_TRACE_SCOPE("vkSetDebugUtilsObjectNameEXT"); + /* + * These object types have a gfxstream Mesa wrapper containing a + * vk_object_base, so the common implementation can safely dereference + * the handle. This list corresponds to the gfxstream_vk_* structs + * defined in gfxstream_vk_private.h. + */ + switch (pNameInfo->objectType) { + case VK_OBJECT_TYPE_INSTANCE: + case VK_OBJECT_TYPE_PHYSICAL_DEVICE: + case VK_OBJECT_TYPE_DEVICE: + case VK_OBJECT_TYPE_QUEUE: + case VK_OBJECT_TYPE_COMMAND_BUFFER: + case VK_OBJECT_TYPE_COMMAND_POOL: + case VK_OBJECT_TYPE_BUFFER: + case VK_OBJECT_TYPE_FENCE: + case VK_OBJECT_TYPE_SEMAPHORE: + return vk_common_SetDebugUtilsObjectNameEXT(device, pNameInfo); + default: + return VK_SUCCESS; + } +}