break cyclic meta-layer recursion in loader_add_meta_layer#1968
Conversation
A settings-file meta-layer whose component chain loops back on itself skips the verify_all_meta_layers cycle check and recurses through loader_add_meta_layer until the stack overflows. Guard the expansion with a per-layer flag so a layer already on the stack stops instead of recursing.
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
charles-lunarg
left a comment
There was a problem hiding this comment.
OSS-Fuzz found a similar crash that I fixed by simply disabling meta layers from enabling other meta layers.
Since meta-layers aren't necessary any more, I am content with removing the ability for meta layers to enable other meta layers. That feature was never required, only existed as a fallout of 'yeah I guess this could work'. Having variables that live in the layer properties that mutate as the layers are loaded is a counter intuitive design.
In other words, I'm happy to take this PR as it, but would also would be happy with a 'remove this feature' PR. I am happy to make that PR as well, since fixing this bug is already a big help.
|
CI Vulkan-Loader build queued with queue ID 38308. |
|
CI Vulkan-Loader build # 3630 running. |
|
CI Vulkan-Loader build # 3630 passed. |
Found while fuzzing the loader settings file with malformed layer manifests.
Two meta-layers whose
component_layerslist each other recurseloader_add_meta_layer->loader_add_implicit_layer->loader_add_meta_layerand never stop. The stack runs out insidevkCreateInstance.verify_all_meta_layersalready catches these cycles and drops the offending layers, but it only runs over layers found through normal discovery. Layers named invk_loader_settings.jsonarrive throughget_settings_layersand never reach that pass, so the cycle is still live once expansion starts. b56f871 took the recursion out ofloader_find_layer_name_in_meta_layerfor the same reason; this sibling was missed.The guard is a per-layer
is_being_expandedflag, set on entry toloader_add_meta_layerand cleared once its components are walked. Re-entering a layer already on the expansion stack logs a warning and returns rather than recursing. A well-formed meta-layer that pulls in another meta-layer still expands exactly as before.Added
SettingsFile.CyclicMetaLayerComponentDoesNotRecurse, which points two settings meta-layers at each other. It overflows the stack under ASan without the guard and passes with it.