Mesa (staging/22.1): vulkan/wsi/wayland: Fix double free on error condition

[GitLab Mirror]

Module: Mesa
Branch: staging/22.1
Commit: d9083cff8e793766dd6e8e727e58e1cece471b16
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=d9083cff8e793766dd6e8e727e58e1cece471b16

Author: Iván Briano <ivan.briano at intel.com>
Date:   Fri Apr 29 14:54:46 2022 -0700

vulkan/wsi/wayland: Fix double free on error condition

If wsi_configure_native_image() fails, it will call
wsi_destroy_image_info() itself, so let's try to not call it again from
wsi_wl_swapchain_destroy().

Fixes the CTS tests:
dEQP-VK.wsi.wayland.swapchain.simulate_oom.*

Fixes: b626a5be43d ("vulkan/wsi/wayland: Split image creation")

Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16257>
(cherry picked from commit bf04be17f7f7cb41ef90176a8bc1fad587206046)

---

 .pick_status.json                   |  2 +-
 src/vulkan/wsi/wsi_common_wayland.c | 29 ++++++++++++++++++++++-------
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 64c222f7be3..e7a18e781ac 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -427,7 +427,7 @@
         "description": "vulkan/wsi/wayland: Fix double free on error condition",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "b626a5be43d4cd81d6f6e7c17eef8f9055f555d7"
     },
diff --git a/src/vulkan/wsi/wsi_common_wayland.c b/src/vulkan/wsi/wsi_common_wayland.c
index 39e5a51a8c2..0678556105e 100644
--- a/src/vulkan/wsi/wsi_common_wayland.c
+++ b/src/vulkan/wsi/wsi_common_wayland.c
@@ -1191,12 +1191,9 @@ fail_image:
    return VK_ERROR_OUT_OF_HOST_MEMORY;
 }
 
-static VkResult
-wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
-                         const VkAllocationCallbacks *pAllocator)
+static void
+wsi_wl_swapchain_images_free(struct wsi_wl_swapchain *chain)
 {
-   struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain;
-
    for (uint32_t i = 0; i < chain->base.image_count; i++) {
       if (chain->images[i].buffer) {
          wl_buffer_destroy(chain->images[i].buffer);
@@ -1206,7 +1203,12 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
       }
    }
    wsi_destroy_image_info(&chain->base, &chain->base.image_info);
+}
 
+static void
+wsi_wl_swapchain_chain_free(struct wsi_wl_swapchain *chain,
+                            const VkAllocationCallbacks *pAllocator)
+{
    if (chain->frame)
       wl_callback_destroy(chain->frame);
    if (chain->surface)
@@ -1218,6 +1220,16 @@ wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
    wsi_swapchain_finish(&chain->base);
 
    vk_free(pAllocator, chain);
+}
+
+static VkResult
+wsi_wl_swapchain_destroy(struct wsi_swapchain *wsi_chain,
+                         const VkAllocationCallbacks *pAllocator)
+{
+   struct wsi_wl_swapchain *chain = (struct wsi_wl_swapchain *)wsi_chain;
+
+   wsi_wl_swapchain_images_free(chain);
+   wsi_wl_swapchain_chain_free(chain, pAllocator);
 
    return VK_SUCCESS;
 }
@@ -1319,7 +1331,7 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface,
       result = wsi_wl_image_init(chain, &chain->images[i],
                                  pCreateInfo, pAllocator);
       if (result != VK_SUCCESS)
-         goto fail;
+         goto fail_image_init;
       chain->images[i].busy = false;
    }
 
@@ -1327,8 +1339,11 @@ wsi_wl_surface_create_swapchain(VkIcdSurfaceBase *icd_surface,
 
    return VK_SUCCESS;
 
+fail_image_init:
+   wsi_wl_swapchain_images_free(chain);
+
 fail:
-   wsi_wl_swapchain_destroy(&chain->base, pAllocator);
+   wsi_wl_swapchain_chain_free(chain, pAllocator);
 
    return result;
 }