From 9f062ad75532b2c73003d42d031281a2a6ba1679 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Briano?= Date: Fri, 29 Apr 2022 14:54:46 -0700 Subject: [PATCH] vulkan/wsi/wayland: Fix double free on error condition If wsi_configure_native_image() fails, it will call wsi_destroy_image_info() itself, so let's try to not call it again from wsi_wl_swapchain_destroy(). Fixes the CTS tests: dEQP-VK.wsi.wayland.swapchain.simulate_oom.* Fixes: b626a5be43d ("vulkan/wsi/wayland: Split image creation") Reviewed-by: Lionel Landwerlin Part-of: (cherry picked from commit bf04be17f7f7cb41ef90176a8bc1fad587206046) --- .pick_status.json | 2 +- src/vulkan/wsi/wsi_common_wayland.c | 29 ++++++++++++++++++++++------- 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 17f65f85b9c..b5647bede8c 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -380,7 +380,7 @@ "description": "vulkan/wsi/wayland: Fix double free on error condition", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "because_sha": "b626a5be43d4cd81d6f6e7c17eef8f9055f555d7" }, { diff --git a/src/vulkan/wsi/wsi_common_wayland.c b/src/vulkan/wsi/wsi_common_wayland.c index b66a49560ea..737d232bbc2 100644 --- a/src/vulkan/wsi/wsi_common_wayland.c +++ b/src/vulkan/wsi/wsi_common_wayland.c @@ -1217,12 +1217,9 @@ fail_image: return VK_ERROR_OUT_OF_HOST_MEMORY; } -static VkResult -wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain, - const VkAllocationCallbacks *pAllocator) +static void +wsi_wl_swapchain_images_free(struct wsi_wl_swapchain *chain) { - struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain; - for (uint32_t i = 0; i < chain->base.image_count; i++) { if (chain->images[i].buffer) { wl_buffer_destroy(chain->images[i].buffer); @@ -1232,7 +1229,12 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain, } } wsi_destroy_image_info(&chain->base, &chain->base.image_info); +} +static void +wsi_wl_swapchain_chain_free(struct wsi_wl_swapchain *chain, + const VkAllocationCallbacks *pAllocator) +{ if (chain->frame) wl_callback_destroy(chain->frame); if (chain->surface) @@ -1244,6 +1246,16 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain, wsi_swapchain_finish(&chain->base); vk_free(pAllocator, chain); +} + +static VkResult +wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain, + const VkAllocationCallbacks *pAllocator) +{ + struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain; + + wsi_wl_swapchain_images_free(chain); + wsi_wl_swapchain_chain_free(chain, pAllocator); return VK_SUCCESS; } @@ -1345,7 +1357,7 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface, result = wsi_wl_image_init(chain, &chain->images[i], pCreateInfo, pAllocator); if (result != VK_SUCCESS) - goto fail; + goto fail_image_init; chain->images[i].busy = false; } @@ -1353,8 +1365,11 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface, return VK_SUCCESS; +fail_image_init: + wsi_wl_swapchain_images_free(chain); + fail: - wsi_wl_swapchain_destroy(&chain->base, pAllocator); + wsi_wl_swapchain_chain_free(chain, pAllocator); return result; }