libvulkan: Fix double-free, refactor instance destruction (4775cc0d) · Commits · e / os / android_frameworks_native-old

vulkan/libvulkan/loader.cpp

+28 −35

Original line number	Original line	Diff line number	Diff line
	@@ -528,17 +528,24 @@ void* StripCreateExtensions(const void* pNext) {
	return create_info;		return create_info;
	}		}

	// Separate out cleaning up the layers and instance storage		// Clean up and deallocate an Instance; called from both the failure paths in
	// to avoid code duplication in the many failure cases in		// CreateInstance_Top as well as from DestroyInstance_Top. This function does
	// in CreateInstance_Top		// not call down the dispatch chain; that should be done before calling this
	void TeardownInstance(		// function, iff the lower vkCreateInstance call has been made and returned
	VkInstance vkinstance,		// successfully.
	const VkAllocationCallbacks* /* allocator */) {		void DestroyInstance(Instance* instance,
	Instance& instance = GetDispatchParent(vkinstance);		const VkAllocationCallbacks* allocator) {
	instance.active_layers.clear();		if (instance->message) {
	const VkAllocationCallbacks* alloc = instance.alloc;		PFN_vkDestroyDebugReportCallbackEXT destroy_debug_report_callback;
	instance.~Instance();		destroy_debug_report_callback =
	alloc->pfnFree(alloc->pUserData, &instance);		reinterpret_cast<PFN_vkDestroyDebugReportCallbackEXT>(
			GetInstanceProcAddr_Top(instance->handle,
			"vkDestroyDebugReportCallbackEXT"));
			destroy_debug_report_callback(instance->handle, instance->message,
			allocator);
			}
			instance->~Instance();
			allocator->pfnFree(allocator->pUserData, instance);
	}		}

	} // anonymous namespace		} // anonymous namespace
	@@ -941,14 +948,7 @@ void DestroyInstance_Bottom(VkInstance vkinstance,
	if (instance.drv.instance != VK_NULL_HANDLE &&		if (instance.drv.instance != VK_NULL_HANDLE &&
	instance.drv.dispatch.DestroyInstance) {		instance.drv.dispatch.DestroyInstance) {
	instance.drv.dispatch.DestroyInstance(instance.drv.instance, allocator);		instance.drv.dispatch.DestroyInstance(instance.drv.instance, allocator);
	}		instance.drv.instance = VK_NULL_HANDLE;
	if (instance.message) {
	PFN_vkDestroyDebugReportCallbackEXT destroy_debug_report_callback;
	destroy_debug_report_callback =
	reinterpret_cast<PFN_vkDestroyDebugReportCallbackEXT>(
	vkGetInstanceProcAddr(vkinstance,
	"vkDestroyDebugReportCallbackEXT"));
	destroy_debug_report_callback(vkinstance, instance.message, allocator);
	}		}
	}		}

	@@ -1093,8 +1093,7 @@ VkResult CreateInstance_Top(const VkInstanceCreateInfo* create_info,

	result = ActivateAllLayers(create_info, instance, instance);		result = ActivateAllLayers(create_info, instance, instance);
	if (result != VK_SUCCESS) {		if (result != VK_SUCCESS) {
	DestroyInstance_Bottom(instance->handle, allocator);		DestroyInstance(instance, allocator);
	TeardownInstance(instance->handle, allocator);
	return result;		return result;
	}		}

	@@ -1115,8 +1114,7 @@ VkResult CreateInstance_Top(const VkInstanceCreateInfo* create_info,
	sizeof(VkLayerInstanceLink) * instance->active_layers.size()));		sizeof(VkLayerInstanceLink) * instance->active_layers.size()));
	if (!layer_instance_link_info) {		if (!layer_instance_link_info) {
	ALOGE("Failed to alloc Instance objects for layers");		ALOGE("Failed to alloc Instance objects for layers");
	DestroyInstance_Bottom(instance->handle, allocator);		DestroyInstance(instance, allocator);
	TeardownInstance(instance->handle, allocator);
	return VK_ERROR_OUT_OF_HOST_MEMORY;		return VK_ERROR_OUT_OF_HOST_MEMORY;
	}		}

	@@ -1143,8 +1141,7 @@ VkResult CreateInstance_Top(const VkInstanceCreateInfo* create_info,
	reinterpret_cast<PFN_vkCreateInstance>(		reinterpret_cast<PFN_vkCreateInstance>(
	next_gipa(VK_NULL_HANDLE, "vkCreateInstance"));		next_gipa(VK_NULL_HANDLE, "vkCreateInstance"));
	if (!create_instance) {		if (!create_instance) {
	DestroyInstance_Bottom(instance->handle, allocator);		DestroyInstance(instance, allocator);
	TeardownInstance(instance->handle, allocator);
	return VK_ERROR_INITIALIZATION_FAILED;		return VK_ERROR_INITIALIZATION_FAILED;
	}		}
	VkLayerInstanceCreateInfo instance_create_info;		VkLayerInstanceCreateInfo instance_create_info;
	@@ -1170,14 +1167,10 @@ VkResult CreateInstance_Top(const VkInstanceCreateInfo* create_info,
	}		}

	result = create_instance(&local_create_info, allocator, &local_instance);		result = create_instance(&local_create_info, allocator, &local_instance);
			if (enable_callback)
	if (enable_callback) {
	FreeAllocatedCreateInfo(local_create_info, allocator);		FreeAllocatedCreateInfo(local_create_info, allocator);
	}

	if (result != VK_SUCCESS) {		if (result != VK_SUCCESS) {
	DestroyInstance_Bottom(instance->handle, allocator);		DestroyInstance(instance, allocator);
	TeardownInstance(instance->handle, allocator);
	return result;		return result;
	}		}

	@@ -1195,8 +1188,7 @@ VkResult CreateInstance_Top(const VkInstanceCreateInfo* create_info,
	return VK_ERROR_INITIALIZATION_FAILED;		return VK_ERROR_INITIALIZATION_FAILED;
	}		}
	destroy_instance(local_instance, allocator);		destroy_instance(local_instance, allocator);
	DestroyInstance_Bottom(instance->handle, allocator);		DestroyInstance(instance, allocator);
	TeardownInstance(instance->handle, allocator);
	return VK_ERROR_INITIALIZATION_FAILED;		return VK_ERROR_INITIALIZATION_FAILED;
	}		}
	*instance_out = local_instance;		*instance_out = local_instance;
	@@ -1244,9 +1236,10 @@ void DestroyInstance_Top(VkInstance vkinstance,
	const VkAllocationCallbacks* allocator) {		const VkAllocationCallbacks* allocator) {
	if (!vkinstance)		if (!vkinstance)
	return;		return;
			if (!allocator)
			allocator = &kDefaultAllocCallbacks;
	GetDispatchTable(vkinstance).DestroyInstance(vkinstance, allocator);		GetDispatchTable(vkinstance).DestroyInstance(vkinstance, allocator);
			DestroyInstance(&(GetDispatchParent(vkinstance)), allocator);
	TeardownInstance(vkinstance, allocator);
	}		}

	VKAPI_ATTR		VKAPI_ATTR