From 0ba74892437361eafc99ae1fbfeb2a51295108ad Mon Sep 17 00:00:00 2001 From: Alyssa Rosenzweig Date: Wed, 19 Jun 2024 11:44:44 -0400 Subject: [PATCH] vulkan: fix potential UAF with vk_cmd_enqueue_CmdPushDescriptorSetKHR Signed-off-by: Alyssa Rosenzweig Reported-by: Boris Brezillon Reviewed-by: Boris Brezillon Reviewed-by: Konstantin Seurer Part-of: --- src/vulkan/runtime/vk_cmd_enqueue.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/vulkan/runtime/vk_cmd_enqueue.c b/src/vulkan/runtime/vk_cmd_enqueue.c index e97a19b1d31..1d29453291c 100644 --- a/src/vulkan/runtime/vk_cmd_enqueue.c +++ b/src/vulkan/runtime/vk_cmd_enqueue.c @@ -361,7 +361,13 @@ static void push_descriptors_set_free(struct vk_cmd_queue *queue, struct vk_cmd_queue_entry *cmd) { - struct vk_cmd_push_descriptor_set_khr *pds = &cmd->u.push_descriptor_set_khr; + struct vk_command_buffer *cmd_buffer = + container_of(queue, struct vk_command_buffer, cmd_queue); + struct vk_cmd_push_descriptor_set_khr *pds = &cmd->u.push_descriptor_set_khr; + + VK_FROM_HANDLE(vk_pipeline_layout, vk_layout, pds->layout); + vk_pipeline_layout_unref(cmd_buffer->base.device, vk_layout); + for (unsigned i = 0; i < pds->descriptor_write_count; i++) { VkWriteDescriptorSet *entry = &pds->descriptor_writes[i]; switch (entry->descriptorType) { @@ -411,10 +417,16 @@ vk_cmd_enqueue_CmdPushDescriptorSetKHR(VkCommandBuffer commandBuffer, list_addtail(&cmd->cmd_link, &cmd_buffer->cmd_queue.cmds); pds->pipeline_bind_point = pipelineBindPoint; - pds->layout = layout; pds->set = set; pds->descriptor_write_count = descriptorWriteCount; + /* From the application's perspective, the vk_cmd_queue_entry can outlive the + * layout. Take a reference. + */ + VK_FROM_HANDLE(vk_pipeline_layout, vk_layout, layout); + pds->layout = layout; + vk_pipeline_layout_ref(vk_layout); + if (pDescriptorWrites) { pds->descriptor_writes = vk_zalloc(cmd_buffer->cmd_queue.alloc,