From 8391819a19f872d8aa70bf86c66ca0f44160b515 Mon Sep 17 00:00:00 2001 From: Mark Lobodzinski Date: Wed, 28 Mar 2018 14:24:46 -0600 Subject: layers: Fix DestDescPool data race Data was destroyed after the down-chain call, which left the possibility that before the items could be removed from the data structure that they might be reused which would corrupt validation. Fixed by destroying inside the lock before the down-chain call. Change-Id: Icbc994ef043a1108c84474879617d4ada694b74b --- layers/core_validation.cpp | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) (limited to 'layers/core_validation.cpp') diff --git a/layers/core_validation.cpp b/layers/core_validation.cpp index a3dd9915..9ea19d17 100644 --- a/layers/core_validation.cpp +++ b/layers/core_validation.cpp @@ -4354,16 +4354,18 @@ static bool PreCallValidateDestroyDescriptorPool(layer_data *dev_data, VkDescrip return skip; } -static void PostCallRecordDestroyDescriptorPool(layer_data *dev_data, VkDescriptorPool descriptorPool, - DESCRIPTOR_POOL_STATE *desc_pool_state, VK_OBJECT obj_struct) { - // Any bound cmd buffers are now invalid - invalidateCommandBuffers(dev_data, desc_pool_state->cb_bindings, obj_struct); - // Free sets that were in this pool - for (auto ds : desc_pool_state->sets) { - freeDescriptorSet(dev_data, ds); +static void PreCallRecordDestroyDescriptorPool(layer_data *dev_data, VkDescriptorPool descriptorPool, + DESCRIPTOR_POOL_STATE *desc_pool_state, VK_OBJECT obj_struct) { + if (desc_pool_state) { + // Any bound cmd buffers are now invalid + invalidateCommandBuffers(dev_data, desc_pool_state->cb_bindings, obj_struct); + // Free sets that were in this pool + for (auto ds : desc_pool_state->sets) { + freeDescriptorSet(dev_data, ds); + } + dev_data->descriptorPoolMap.erase(descriptorPool); + delete desc_pool_state; } - dev_data->descriptorPoolMap.erase(descriptorPool); - delete desc_pool_state; } VKAPI_ATTR void VKAPI_CALL DestroyDescriptorPool(VkDevice device, VkDescriptorPool descriptorPool, @@ -4374,14 +4376,12 @@ VKAPI_ATTR void VKAPI_CALL DestroyDescriptorPool(VkDevice device, VkDescriptorPo unique_lock_t lock(global_lock); bool skip = PreCallValidateDestroyDescriptorPool(dev_data, descriptorPool, &desc_pool_state, &obj_struct); if (!skip) { + PreCallRecordDestroyDescriptorPool(dev_data, descriptorPool, desc_pool_state, obj_struct); lock.unlock(); dev_data->dispatch_table.DestroyDescriptorPool(device, descriptorPool, pAllocator); - lock.lock(); - if (descriptorPool != VK_NULL_HANDLE) { - PostCallRecordDestroyDescriptorPool(dev_data, descriptorPool, desc_pool_state, obj_struct); - } } } + // Verify cmdBuffer in given cb_node is not in global in-flight set, and return skip result // If this is a secondary command buffer, then make sure its primary is also in-flight // If primary is not in-flight, then remove secondary from global in-flight set -- cgit v1.2.3