Skip to content

lavapipe,radv: Fix vk_instance_init vk_error instance use-after-free

If vk_instance_init fails, these drivers call vk_error for the instance, but they free the instance before the call, so vk_error tries to access an already deleted object.

Passing NULL to vk_error instead, similar to what anv, panvk, tu and v3dv do. It's also not safe in general to call vk_error before freeing the instance, because vk_instance_init is what initializes the instance and thus the object type queried by vk_error — and its interface doesn't explicitly guarantee that the object type will be initialized even in case it fails.

Merge request reports