Mesa (staging/22.0): vulkan/wsi/wayland: Fix double free on error condition

[GitLab Mirror]

Module: Mesa
Branch: staging/22.0
Commit: 39ac98e3b149d1ac77475ef13e143973063a0b1c
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=39ac98e3b149d1ac77475ef13e143973063a0b1c

Author: Iván Briano <ivan.briano at intel.com>
Date:   Fri Apr 29 14:54:46 2022 -0700

vulkan/wsi/wayland: Fix double free on error condition

If wsi_configure_native_image() fails, it will call
wsi_destroy_image_info() itself, so let's try to not call it again from
wsi_wl_swapchain_destroy().

Fixes the CTS tests:
dEQP-VK.wsi.wayland.swapchain.simulate_oom.*

Fixes: b626a5be43d ("vulkan/wsi/wayland: Split image creation")

Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16257>
(cherry picked from commit bf04be17f7f7cb41ef90176a8bc1fad587206046)

---

 .pick_status.json                   |  2 +-
 src/vulkan/wsi/wsi_common_wayland.c | 29 ++++++++++++++++++++++-------
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 17f65f85b9c..b5647bede8c 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -380,7 +380,7 @@
         "description": "vulkan/wsi/wayland: Fix double free on error condition",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "because_sha": "b626a5be43d4cd81d6f6e7c17eef8f9055f555d7"
     },
     {
diff --git a/src/vulkan/wsi/wsi_common_wayland.c b/src/vulkan/wsi/wsi_common_wayland.c
index b66a49560ea..737d232bbc2 100644
--- a/src/vulkan/wsi/wsi_common_wayland.c
+++ b/src/vulkan/wsi/wsi_common_wayland.c
@@ -1217,12 +1217,9 @@ fail_image:
    return VK_ERROR_OUT_OF_HOST_MEMORY;
 }
 
-static VkResult
-wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
-                         const VkAllocationCallbacks *pAllocator)
+static void
+wsi_wl_swapchain_images_free(struct wsi_wl_swapchain *chain)
 {
-   struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain;
-
    for (uint32_t i = 0; i < chain->base.image_count; i++) {
       if (chain->images[i].buffer) {
          wl_buffer_destroy(chain->images[i].buffer);
@@ -1232,7 +1229,12 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
       }
    }
    wsi_destroy_image_info(&chain->base, &chain->base.image_info);
+}
 
+static void
+wsi_wl_swapchain_chain_free(struct wsi_wl_swapchain *chain,
+                            const VkAllocationCallbacks *pAllocator)
+{
    if (chain->frame)
       wl_callback_destroy(chain->frame);
    if (chain->surface)
@@ -1244,6 +1246,16 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
    wsi_swapchain_finish(&chain->base);
 
    vk_free(pAllocator, chain);
+}
+
+static VkResult
+wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
+                         const VkAllocationCallbacks *pAllocator)
+{
+   struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain;
+
+   wsi_wl_swapchain_images_free(chain);
+   wsi_wl_swapchain_chain_free(chain, pAllocator);
 
    return VK_SUCCESS;
 }
@@ -1345,7 +1357,7 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface,
       result = wsi_wl_image_init(chain, &chain->images[i],
                                  pCreateInfo, pAllocator);
       if (result != VK_SUCCESS)
-         goto fail;
+         goto fail_image_init;
       chain->images[i].busy = false;
    }
 
@@ -1353,8 +1365,11 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface,
 
    return VK_SUCCESS;
 
+fail_image_init:
+   wsi_wl_swapchain_images_free(chain);
+
 fail:
-   wsi_wl_swapchain_destroy(&chain->base, pAllocator);
+   wsi_wl_swapchain_chain_free(chain, pAllocator);
 
    return result;
 }