Skip to content

vulkan/wsi: fix possible double free crash on wsi_destroy_image_info

We got some double free errors with v3dv when running wsi OOM cts tests like this:

dEQP-VK.wsi.xlib.swapchain.simulate_oom.composite_alpha

Those tests run several OOM scenarios, but in some of them what can happens is that wsi_swapchain_init has enough memory to reach the call to configure_image, but this one doesn't have enough memory to finish. So configure_image calls wsi_destroy_image_info and returns failure. Then wsi_swapchain_init gets that error, and calls wsi_swapchain_finish, that among other things, calls again wsi_destroy_image_info.

Note that the crashes are really rare. For v3dv only happened on one fresh RaspbianOS install, to just one person. Also what I described before also happens with anv, and I was not able to reproduce this crash. But as double free is undefined behaviour, I guess that we have been lucky so far.

Edited by Alejandro Piñeiro

Merge request reports